A Server-Side Request Forgery (SSRF) vulnerability exists that could allow unauthorized access to sensitive data. This occurs when an attacker sends a specially crafted document to a vulnerable endpoint, potentially compromising the system’s integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-54924 |
Exploitation
To exploit this vulnerability, an attacker would need to craft a specific document that targets a vulnerable endpoint within the Schneider Electric system. By sending this document, the attacker could potentially gain unauthorized access to sensitive data stored on the server.
Affected Products
- Schneider Electric’s networked devices that process documents.
- Any system configurations that allow for document uploads to vulnerable endpoints.
Mitigation
To mitigate this vulnerability, it is recommended to implement strict input validation and sanitization for documents uploaded to the system. Additionally, ensuring that all software is updated to the latest versions can help protect against known vulnerabilities.