Vulnerability · Published Aug 20, 2025 · Assigned by schneider
CVE-2025-8449
Medium 4.1
In plain English
A medium-severity uncontrolled resource consumption in EcoStruxure Building Operation Workstation from Schneider Eelctric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 4.0)4.1Medium
Exploit odds (30 days)0.3%top 82.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schnieder Electric | EcoStruxure Building Operation Enterprise Server | All 7.x versions – before 7.0.2.348All 5.x versions – before 5.0.3.17009 (CP16) |
| Schneider Electric | EcoStruxure Enterprise Server | All 6.x versions – before 6.0.4.10001 (CP8)All 5.x versions – before 5.0.3.17009 (CP16) |
| Schneider Eelctric | EcoStruxure Building Operation Workstation | All 7.x versions – before 7.0.2.348All 6.x versions – before 6.0.4.10001 (CP8)All 5.x versions – before 5.0.3.17009 (CP16) |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N