Privilege escalation in Schneider Electric Ecostruxure Process Expert
CVE-2025-0327
CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing client request) that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the executable path of the windows services. To be exploited, services need to be restarted.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (5.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Schneider Electric Ecostruxure Process Expert — versions Versions 2020R2, Versions 2021 & 2023 (prior to v4.8.0.5715)
- Schneider Electric Ecostruxure Process Expert For Aveva System Platform — versions Versions 2020R2, Versions 2021 & 2023
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-0327?
- CVE-2025-0327 is a high-severity vulnerability in Schneider Electric Ecostruxure Process Expert, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2025-02-13.
- How severe is CVE-2025-0327?
- High severity. CVSS v3 base score is 7.8 out of 10.