Schneider-Electric
888 CVEs across 2062 Schneider-Electric products. Browse Schneider-Electric vulnerabilities, severities, and proof-of-concept exploits.
Schneider-Electric products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81861 | | 2026-09-11 | CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU function… | |
CVE-2026-3869 | | 2026-09-11 | CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the… | |
CVE-2026-8044 | | 2026-09-09 | CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an at… | |
CVE-2026-77120 | | 2026-09-09 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation t… | |
CVE-2026-19233 | | 2026-09-09 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker… | |
CVE-2026-13348 | | 2026-09-01 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user acco… | |
CVE-2026-13336 | | 2026-09-01 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Ope… | |
CVE-2024-10085 | | 2026-09-01 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when… | |
CVE-2026-14354 | | 2026-07-29 | CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially… | |
CVE-2026-12927 | | 2026-07-29 | CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is import… | |
CVE-2026-0667 | | 2026-07-29 | CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidenti… | |
CVE-2026-9718 | Medium | 6.5 | 2026-06-25 | CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availabi… |
CVE-2026-9717 | High | 7.2 | 2026-06-25 | CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of comman… |
CVE-2026-9716 | High | 7.5 | 2026-06-25 | CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionalit… |
CVE-2026-9651 | Medium | 4.4 | 2026-06-25 | CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account c… |
CVE-2026-9650 | High | 7.5 | 2026-06-25 | CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated atta… |
CVE-2026-8045 | Medium | 6.5 | 2026-06-09 | CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an… |
CVE-2026-6332 | High | 7.5 | 2026-05-14 | CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in reve… |
CVE-2026-6866 | High | 7.5 | 2026-05-12 | CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when cred… |
CVE-2026-6865 | | 2026-05-12 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files wh… | |
CVE-2026-4827 | | 2026-05-12 | CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑man… | |
CVE-2026-4832 | | 2026-04-14 | CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacke… | |
CVE-2026-2405 | Medium | 6.5 | 2026-04-14 | CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Ad… |
CVE-2026-2404 | Medium | 5.3 | 2026-04-14 | CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security… |
CVE-2026-2403 | Medium | 4.3 | 2026-04-14 | CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a… |
CVE-2026-2402 | Medium | 5.3 | 2026-04-14 | CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by perfo… |
CVE-2026-2401 | Medium | 5.0 | 2026-04-14 | CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user ex… |
CVE-2026-2400 | Medium | 4.3 | 2026-04-14 | CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web Ad… |
CVE-2026-2399 | Medium | 6.1 | 2026-04-14 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files overwritten with tex… |
CVE-2026-2273 | High | 8.2 | 2026-03-10 | CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering works… |
CVE-2026-1286 | Medium | 6.5 | 2026-03-10 | CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on wo… |
CVE-2025-13957 | | 2026-03-10 | CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and… | |
CVE-2025-13902 | Medium | 5.4 | 2026-03-10 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated… |
CVE-2025-13901 | Medium | 5.3 | 2026-03-10 | CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticate… |
CVE-2025-11739 | High | 7.8 | 2026-03-10 | CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authent… |
CVE-2026-1227 | | 2026-02-11 | CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within… | |
CVE-2026-1226 | | 2026-02-11 | CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when mali… | |
CVE-2025-13905 | | 2026-01-29 | CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable servi… | |
CVE-2025-13845 | High | 7.8 | 2026-01-15 | CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody. |
CVE-2025-13844 | Medium | 5.3 | 2026-01-15 | CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the a… |
CVE-2025-11567 | | 2025-11-12 | CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured. | |
CVE-2025-11566 | | 2025-11-12 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the… | |
CVE-2025-11565 | | 2025-11-12 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web… | |
CVE-2025-9997 | | 2025-09-09 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in B… | |
CVE-2025-9996 | | 2025-09-09 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any s… | |
CVE-2025-7746 | | 2025-09-09 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected… | |
CVE-2025-8449 | | 2025-08-20 | CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted reque… | |
CVE-2025-8448 | | 2025-08-20 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when… | |
CVE-2025-54927 | Medium | 4.9 | 2025-08-20 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive f… |
CVE-2025-54926 | High | 7.2 | 2025-08-20 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an auth… |
CVE-2025-54925 | High | 7.5 | 2025-08-20 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the applica… |
CVE-2025-54924 | High | 7.5 | 2025-08-20 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially craf… |
CVE-2025-54923 | | 2025-08-20 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated us… | |
CVE-2025-8453 | Medium | 6.7 | 2025-08-20 | CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user… |
CVE-2025-5296 | High | 7.3 | 2025-08-18 | CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written to protected locatio… |
CVE-2025-6625 | High | 7.5 | 2025-08-18 | CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device. |
CVE-2025-6788 | | 2025-07-11 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authentic… | |
CVE-2025-50125 | | 2025-07-11 | A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via th… | |
CVE-2025-50124 | | 2025-07-11 | A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account vi… | |
CVE-2025-50123 | | 2025-07-11 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account whe… | |
CVE-2025-50122 | | 2025-07-11 | A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with… | |
CVE-2025-50121 | | 2025-07-11 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remo… | |
CVE-2025-6438 | | 2025-07-11 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external e… | |
CVE-2025-5743 | Medium | 5.5 | 2025-06-10 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote control over th… |
CVE-2025-5742 | Medium | 5.4 | 2025-06-10 | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated user modifies configura… |
CVE-2025-5741 | Medium | 4.9 | 2025-06-10 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file reads from the char… |
CVE-2025-5740 | High | 7.2 | 2025-06-10 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file writes when an auth… |
CVE-2025-3905 | Medium | 5.4 | 2025-06-10 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variables that could cau… |
CVE-2025-3899 | Medium | 5.4 | 2025-06-10 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Certificates page on Webserver that could… |
CVE-2025-3898 | Medium | 6.5 | 2025-06-10 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing i… |
CVE-2025-3117 | Medium | 5.4 | 2025-06-10 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration file paths that could… |
CVE-2025-3116 | Medium | 6.5 | 2025-06-10 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS re… |
CVE-2025-3112 | Medium | 6.5 | 2025-06-10 | CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user sends manipulated HTTPS… |
CVE-2025-2875 | High | 7.5 | 2025-05-14 | CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticate… |
CVE-2025-3916 | | 2025-05-13 | CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially execute arbitrary… | |
CVE-2025-2442 | Medium | 6.8 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in t… |
CVE-2025-2441 | Medium | 4.6 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having p… |
CVE-2025-2440 | Medium | 4.2 | 2025-04-09 | CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a maliciou… |
CVE-2025-2223 | High | 7.8 | 2025-04-09 | CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a… |
CVE-2025-2222 | High | 7.8 | 2025-04-09 | CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privilege escalation fol… |
CVE-2025-2002 | Medium | 6.0 | 2025-03-12 | CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server i… |
CVE-2025-1960 | Critical | 9.8 | 2025-03-12 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a syste… |
CVE-2025-0813 | Medium | 6.8 | 2025-03-12 | CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physica… |
CVE-2025-0816 | Medium | 6.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device. |
CVE-2025-0815 | Medium | 6.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are sent to the device. |
CVE-2025-0814 | Medium | 5.3 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC6185… |
CVE-2025-0327 | High | 7.8 | 2025-02-13 | CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing cl… |
CVE-2025-1070 | High | 8.1 | 2025-02-13 | CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded. |
CVE-2025-1060 | High | 7.5 | 2025-02-13 | CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed b… |
CVE-2025-1059 | High | 7.5 | 2025-02-13 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to t… |
CVE-2025-1058 | High | 8.1 | 2025-02-13 | CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded. |
CVE-2024-10083 | Medium | 5.5 | 2025-02-13 | CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver interface is invoked… |
CVE-2024-8401 | Medium | 5.4 | 2025-01-28 | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folde… |
CVE-2024-12703 | High | 7.8 | 2025-01-17 | CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on wo… |
CVE-2024-12142 | High | 8.6 | 2025-01-17 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modifi… |
CVE-2024-10498 | Medium | 6.5 | 2025-01-17 | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow an unauthorized attacker to modify confi… |
CVE-2024-10497 | High | 8.8 | 2025-01-17 | CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outside those defined b… |
CVE-2024-12476 | High | 7.8 | 2025-01-17 | CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and… |
CVE-2024-12399 | High | 7.1 | 2025-01-17 | CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confide… |
CVE-2024-11425 | High | 7.5 | 2025-01-17 | CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticated user is sending a… |