A CWE-59 vulnerability exists in Schneider Electric products, allowing improper link resolution before file access. This could lead to arbitrary data being written to protected locations, potentially resulting in privilege escalation, file corruption, and exposure of sensitive information. A low-privileged attacker could exploit this vulnerability by tampering with the installation folder.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7 | CVE-2025-5296 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can manipulate the installation folder of the affected product. By doing so, they can cause arbitrary data to be written to protected locations, leading to potential privilege escalation and other malicious outcomes.
Affected Products
- Schneider Electric products that utilize file access mechanisms vulnerable to improper link resolution.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Schneider Electric and to ensure that proper access controls are in place to prevent unauthorized modifications to installation folders.