A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network. This vulnerability can be exploited by users with low privileges, leading to potential service disruptions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.1 | CVE-2025-8449 |
Exploitation
To exploit this vulnerability, an authenticated user must send a specially crafted request to a specific endpoint within the BMS network. The attack requires low privileges and can lead to denial of service, affecting the availability of the system.
Affected Products
- Building Management System (BMS): Vulnerable to denial of service due to uncontrolled resource consumption.
Mitigation
To mitigate this vulnerability, it is recommended to implement strict access controls and monitor network traffic for unusual requests. Regular updates and patches from Schneider Electric should also be applied to ensure system security.