TI-2025-00262 Aliases CVE-2025-0327 GHSA-4v4v-fcfx-x6mg

Improper privilege management in Schneider Electric EcoStruxure Process Expert

LOW 38CWE-269Published 2025-02-13 · Updated 2025-02-13

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing client request) that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the executable path of the windows services. To be exploited, services need to be restarted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00165 5th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Schneider Electric	EcoStruxure Process Expert	Versions 2020R2; Versions 2021 & 2023 (prior to v4.8.0.5715)	—	No fix listed	CNA
Schneider Electric	EcoStruxure Process Expert for AVEVA System Platform	Versions 2020R2; Versions 2021 & 2023	—	No fix listed	CNA

EcoStruxure Process Expert VendorSchneider Electric Affected Versions 2020R2; Versions 2021 & 2023 (prior to v4.8.0.5715) Fixed in — No fix listed CNA
EcoStruxure Process Expert for AVEVA System Platform VendorSchneider Electric Affected Versions 2020R2; Versions 2021 & 2023 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-0327
2026-10-03 Alias added: GHSA-4v4v-fcfx-x6mg

References

Other 1

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-042-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-03.pdf

TI-2018-05679 SQL injection in U.motion Builder software version 1.3.4 KEVCVSS 3.1CRITICAL 9.8
TI-2021-05589 Hard-coded credentials in EVlink City , EVlink Parking , and EVlink Smart Wallbox CVSS 3.1CRITICAL 9.8
TI-2022-15561 OS command injection in Schneider Electric SpaceLogic C-Bus Home Controller CVSS 3.1HIGH 8.8
TI-2023-04970 Path traversal in Schneider Electric C-Bus Toolkit CVSS 3.1CRITICAL 9.8
TI-2019-04862 Improper handling of exceptional conditions in Schneider Electric Modicon M580 CVSS 3.1HIGH 7.5
TI-2018-05690 Improper handling of exceptional conditions in Modicon M580 Modicon M340 Modicon Quantum… CVSS 3.1HIGH 7.5

See all 888 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences