Deserialization Vulnerability in Schneider Electric Network Services
CVE-2025-54923

8.7HIGH

Key Information:

Vendor

Schneider Electric
Status
Ecostruxure™ Power Monitoring Expert (pme)
Ecostruxure™ Power Operation (epo) Advanced Reporting And Dashboards Module
Vendor
CVE Published:
20 August 2025

What is CVE-2025-54923?

A vulnerability in Schneider Electric's network services arises from the deserialization of untrusted data, which could enable authenticated users to send crafted data that leads to remote code execution. This exploitation may severely compromise system integrity, highlighting the need for stringent security measures.

Affected Version(s)

EcoStruxure™ Power Monitoring Expert (PME) Version 2022

EcoStruxure™ Power Monitoring Expert (PME) Version 2023

EcoStruxure™ Power Monitoring Expert (PME) Version 2024

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.