Vulnerability · Published Sep 9, 2025 · Assigned by schneider
CVE-2025-7746
Medium 5.3
In plain English
A medium-severity cross-site scripting in ATS490 Altivar Soft Starter from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.4%top 62.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives | all versions |
| Schneider Electric | ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drives | all versions |
| Schneider Electric | ILC992 InterLink Converter | all versions |
| Schneider Electric | ATV340E Altivar Machine Drives | all versions |
| Schneider Electric | ATV6000 Medium Voltage Altivar Process Drives | all versions |
| Schneider Electric | ATS490 Altivar Soft Starter | all versions |
| Schneider Electric | VW3A3720 & VW3A3721 Altivar Process Communication Modules | all versions |
| Schneider Electric | VW3A3530D: ATVdPAC module | all versions – before v25.0 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N