A vulnerability identified as CWE-22, related to improper limitation of a pathname to a restricted directory (Path Traversal), could allow unauthorized access to sensitive files. This issue arises when an authenticated attacker uses a crafted path input that the system processes. The vulnerability poses a significant risk due to its potential impact on confidentiality.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.9 | CVE-2025-54927 |
Exploitation
To exploit this vulnerability, an authenticated attacker can craft a specific path input that the system will process, potentially leading to unauthorized access to sensitive files. The attack requires high privileges, making it essential for the attacker to have some level of access to the system.
Affected Products
- Schneider Electric systems that process user input for file paths, particularly those with high privilege access.
Mitigation
To mitigate this vulnerability, it is recommended to implement strict input validation and sanitization for any user-provided path inputs. Additionally, limiting user privileges and regularly updating systems can help reduce the risk of exploitation.