Uncontrolled resource consumption in Schnieder Electric EcoStruxure Building Operation…
Priority LOW 19CWE-400Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00259 17th percentileScored 2026-11-07
Fix Fixed EcoStruxure Building Operation Enterprise Server (Schnieder Electric): 7.0.2.348, All 6.x versions, 5.0.3.17009 (CP16)EcoStruxure Enterprise Server (Schneider Electric): All 7.x versions, 6.0.4.10001 (CP8), 5.0.3.17009 (CP16)+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schnieder Electric | EcoStruxure Building Operation Enterprise Server | All 7.x versions to before 7.0.2.348; All 5.x versions to before 5.0.3.17009 (CP16) | 7.0.2.348, All 6.x versions, 5.0.3.17009 (CP16) | Patch available | CNA |
| Schneider Electric | EcoStruxure Enterprise Server | All 6.x versions to before 6.0.4.10001 (CP8); All 5.x versions to before 5.0.3.17009 (CP16) | All 7.x versions, 6.0.4.10001 (CP8), 5.0.3.17009 (CP16) | Patch available | CNA |
| Schneider Eelctric | EcoStruxure Building Operation Workstation | All 7.x versions to before 7.0.2.348; All 6.x versions to before 6.0.4.10001 (CP8); All 5.x versions to before 5.0.3.17009 (CP16) | 7.0.2.348, 6.0.4.10001 (CP8), 5.0.3.17009 (CP16) | Patch available | CNA |
- EcoStruxure Building Operation Enterprise Server VendorSchnieder Electric Affected All 7.x versions to before 7.0.2.348; All 5.x versions to before 5.0.3.17009 (CP16) Fixed in 7.0.2.348, All 6.x versions, 5.0.3.17009 (CP16) Patch available CNA
- EcoStruxure Enterprise Server VendorSchneider Electric Affected All 6.x versions to before 6.0.4.10001 (CP8); All 5.x versions to before 5.0.3.17009 (CP16) Fixed in All 7.x versions, 6.0.4.10001 (CP8), 5.0.3.17009 (CP16) Patch available CNA
- EcoStruxure Building Operation Workstation VendorSchneider Eelctric Affected All 7.x versions to before 7.0.2.348; All 6.x versions to before 6.0.4.10001 (CP8); All 5.x versions to before 5.0.3.17009 (CP16) Fixed in 7.0.2.348, 6.0.4.10001 (CP8), 5.0.3.17009 (CP16) Patch available CNA
Remediation
- Fix · CNA EcoStruxure Building Operation Enterprise Server (Schnieder Electric) Fixed in 7.0.2.348, All 6.x versions, 5.0.3.17009 (CP16)
- Fix · CNA EcoStruxure Enterprise Server (Schneider Electric) Fixed in All 7.x versions, 6.0.4.10001 (CP8), 5.0.3.17009 (CP16)
- Fix · CNA EcoStruxure Building Operation Workstation (Schneider Eelctric) Fixed in 7.0.2.348, 6.0.4.10001 (CP8), 5.0.3.17009 (CP16)
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Schneider Electric EcoStruxure Enterprise Server 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-07734 Information disclosure in Schneider Eelctric EcoStruxure Building Operation Enterprise…Priority LOW 6
- Release ·
Schneider Eelctric EcoStruxure Building Operation Workstation 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-07734 Information disclosure in Schneider Eelctric EcoStruxure Building Operation Enterprise…Priority LOW 6
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8449
- 2026-10-03 Alias added: GHSA-mwcm-qxp3-wwj9
References
Sources
- CVE-2025-8449 · CVE Program
- CVE-2025-8449 · NVD
- FIRST EPSS
- GHSA-mwcm-qxp3-wwj9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences