Deserialization Vulnerability in Schneider Electric's Product
CVE-2025-11739

8.5HIGH

Key Information:

Vendor

Schneider Electric
Status
Ecostruxure™ Power Monitoring Expert (pme)
Ecostruxure™ Power Operation (epo) Advanced Reporting And Dashboards Module
Vendor
CVE Published:
10 March 2026

What is CVE-2025-11739?

A vulnerability exists within Schneider Electric's systems where deserialization of untrusted data may lead to the execution of arbitrary code with administrative privileges. A locally authenticated attacker could exploit this flaw by sending a maliciously crafted data stream, initiating unsafe deserialization. This scenario underscores the need for rigorous data validation and security measures to protect against unauthorized access and potential exploitation.

Affected Version(s)

EcoStruxure™ Power Monitoring Expert (PME) Version 2022

EcoStruxure™ Power Monitoring Expert (PME) Version 2023

EcoStruxure™ Power Monitoring Expert (PME) Version 2023 R2

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.