CVE-2025-6438 — Schneider Electric / EcoStruxure™ IT Data Center Expert

CVE-2025-6438

Schneider Electric / EcoStruxure™ IT Data Center Expert PUBLISHED

Description (CNA)

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account.

Affected (CNA)

Vendor / product	Versions
Schneider Electric / EcoStruxure™ IT Data Center Expert	affected 8.3 through Prior to

CWE

CWE-611

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/Jul/5