A CWE-59 vulnerability exists in Schneider Electric products, allowing improper link resolution before file access. This could lead to arbitrary data being written to protected locations, potentially resulting in privilege escalation, file corruption, exposure of sensitive information, or persistent denial of service. The vulnerability can be exploited by a low-privileged attacker who tampers with the installation folder.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7 | CVE-2025-5296 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can manipulate the installation folder of the affected product. By tampering with the link resolution process, the attacker can write arbitrary data to protected locations, leading to potential privilege escalation and other harmful effects.
Affected Products
- Schneider Electric products that utilize file access mechanisms vulnerable to improper link resolution.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security patches provided by Schneider Electric and to ensure that installation folders are secured against unauthorized access. Regular audits and monitoring of file access can also help in identifying potential exploitation attempts.