Read the docs
TI-2025-07071 Aliases CVE-2025-7746GHSA-v42j-xh9r-gfmm

Cross-site scripting in Schneider Electric ATV630/650/660/680/6A0/6B0/6L0 Altivar Process…

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Fixed VW3A3530D: ATVdPAC module (Schneider Electric): v25.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schneider ElectricATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drivesall versions—No fix listedCNA
Schneider ElectricATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drivesall versions—No fix listedCNA
Schneider ElectricILC992 InterLink Converterall versions—No fix listedCNA
Schneider ElectricATV340E Altivar Machine Drivesall versions—No fix listedCNA
Schneider ElectricATV6000 Medium Voltage Altivar Process Drivesall versions—No fix listedCNA
Schneider ElectricATS490 Altivar Soft Starterall versions—No fix listedCNA
Schneider ElectricVW3A3720 & VW3A3721 Altivar Process Communication Modulesall versions—No fix listedCNA
Schneider ElectricVW3A3530D: ATVdPAC moduleall versions to before v25.0v25.0Patch availableCNA
  • ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives VendorSchneider Electric Affected all versions Fixed in — No fix listed CNA
  • ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drives VendorSchneider Electric Affected all versions Fixed in — No fix listed CNA
  • ILC992 InterLink Converter VendorSchneider Electric Affected all versions Fixed in — No fix listed CNA
  • ATV340E Altivar Machine Drives VendorSchneider Electric Affected all versions Fixed in — No fix listed CNA
  • ATV6000 Medium Voltage Altivar Process Drives VendorSchneider Electric Affected all versions Fixed in — No fix listed CNA
  • ATS490 Altivar Soft Starter VendorSchneider Electric Affected all versions Fixed in — No fix listed CNA
  • VW3A3720 & VW3A3721 Altivar Process Communication Modules VendorSchneider Electric Affected all versions Fixed in — No fix listed CNA
  • VW3A3530D: ATVdPAC module VendorSchneider Electric Affected all versions to before v25.0 Fixed in v25.0 Patch available CNA

Remediation

  • Fix · CNA VW3A3530D: ATVdPAC module (Schneider Electric) Fixed in v25.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-7746
  2. 2026-10-03 Alias added: GHSA-v42j-xh9r-gfmm

References

Other 1

  • TI-2018-05679 SQL injection in U.motion Builder software version 1.3.4 KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05589 Hard-coded credentials in EVlink City , EVlink Parking , and EVlink Smart Wallbox CVSS 3.1CRITICAL 9.8
  • TI-2022-15561 OS command injection in Schneider Electric SpaceLogic C-Bus Home Controller CVSS 3.1HIGH 8.8
  • TI-2023-04970 Path traversal in Schneider Electric C-Bus Toolkit CVSS 3.1CRITICAL 9.8
  • TI-2019-04862 Improper handling of exceptional conditions in Schneider Electric Modicon M580 CVSS 3.1HIGH 7.5
  • TI-2018-05690 Improper handling of exceptional conditions in Modicon M580 Modicon M340 Modicon Quantum… CVSS 3.1HIGH 7.5
See all 888 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences