CVE-2025-54923 Vulnerability Details

Record summary

CVE-2025-54923 has a selected CVSS score of 8.7 (high).

Description

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 20, 2025 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
EcoStruxure™ Power Monitoring Expert (PME) Browse Schneider Electric / EcoStruxure™ Power Monitoring Expert (PME) Default status: unaffected	CVE List	Version 2022	affected
		Version 2023	affected
		Version 2024	affected
		Version 2024 R2	affected
EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Browse Schneider Electric / EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Default status: unaffected	CVE List	Version 2022 w/ Advanced Reporting Module	affected
	CVE List	Version 2024 w/ Advanced Reporting Module	affected

References

download.schneider-electric.com

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-54923