Back to Database
Status published
Low
CVE-2025-8448
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability...
Vulnerability Description
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-8448
Credits & Attribution
No credits recorded in the NVD database.
Affected Vendor
Schneider Eelctric
View all reports →Affected Software
EcoStruxure Building Operation Enterprise Server, EcoStruxure Enterprise Server, EcoStruxure Building Operation Workstation
Vulnerable Versions:
All 7.x versions, All 6.x versions, All 5.x versions
Timeline
Official Publish:
August 20th, 2025
Last Modified:
September 9th, 2025
Added to House:
July 22nd, 2026