Server-Side Request Forgery Vulnerability in Schneider Electric Products
CVE-2025-54924

7.5HIGH

Key Information:

Vendor

Schneider Electric
Status
Ecostruxure™ Power Monitoring Expert (pme)
Ecostruxure™ Power Operation (epo) Advanced Reporting And Dashboards Module
Vendor
CVE Published:
20 August 2025

What is CVE-2025-54924?

A server-side request forgery (SSRF) vulnerability exists in Schneider Electric products, potentially enabling unauthorized access to sensitive data. Attackers can exploit this vulnerability by sending specially crafted documents to vulnerable endpoints, which may lead to unauthorized data handling or exposure. It is crucial for affected users to implement the necessary security measures to mitigate this risk.

Affected Version(s)

EcoStruxure™ Power Monitoring Expert (PME) Version 2022

EcoStruxure™ Power Monitoring Expert (PME) Version 2023

EcoStruxure™ Power Monitoring Expert (PME) Version 2024

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-54924 : Server-Side Request Forgery Vulnerability in Schneider Electric Products