Riskcovery

CVE-2025-7746

State
Published
Severity
5.3 Medium
Published
Sep 9, 2025
Updated
Nov 3, 2025
Reserved
Jul 17, 2025

Read the record on cve.org

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:Nschneider

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

ProductVersions
ATV630/650/660/680/6A0/6B0/6L0 Altivar Process DrivesSchneider Electric
  • all versionsAffected
ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process DrivesSchneider Electric
  • all versionsAffected
ILC992 InterLink ConverterSchneider Electric
  • all versionsAffected
ATV340E Altivar Machine DrivesSchneider Electric
  • all versionsAffected
ATV6000 Medium Voltage Altivar Process DrivesSchneider Electric
  • all versionsAffected
ATS490 Altivar Soft StarterSchneider Electric
  • all versionsAffected
VW3A3720 & VW3A3721 Altivar Process Communication ModulesSchneider Electric
  • all versionsAffected
VW3A3530D: ATVdPAC moduleSchneider Electric
  • all versions to before v25.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.