Vulnerability · Published Aug 18, 2025 · Assigned by schneider
CVE-2025-6625
High 7.5
In plain English
A high-severity improper input validation in BMXNGD0100: M580 Global Data module from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Modicon M340 | All versions |
| Schneider ELectric | BMXNOR0200H: Ethernet / Serial RTU Module | All versions |
| Schneider Electric | BMXNGD0100: M580 Global Data module | All versions |
| Schneider Electric | BMXNOC0401: Modicon M340 X80 Ethernet Communication modules | All versions |
| Schneider Electric | BMXNOE0100: Modbus/TCP Ethernet Modicon M340 module | Versions prior to 3.60 |
| Schneider Electric | BMXNOE0110: Modbus/TCP Ethernet Modicon M340 FactoryCast module | Versions prior to 6.80 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H