A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when a specifically crafted FTP command is sent to the device. This vulnerability can lead to significant availability impacts, making it critical for affected users to address it promptly.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-6625 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted FTP command to the affected device over the network. This command can trigger a Denial Of Service condition, rendering the device inoperable until it is manually reset or restarted.
Affected Products
- Schneider Electric FTP-enabled devices: These devices are susceptible to the Denial Of Service attack due to improper input validation.
Mitigation
To mitigate this vulnerability, users should ensure that their devices are updated with the latest firmware and security patches provided by Schneider Electric. Additionally, restricting access to the FTP service and monitoring network traffic can help prevent exploitation.