CVE-2025-54924 Vulnerability Details

Record summary

CVE-2025-54924 has a selected CVSS score of 7.5 (high).

Description

CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 20, 2025 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
EcoStruxure™ Power Monitoring Expert (PME) Browse Schneider Electric / EcoStruxure™ Power Monitoring Expert (PME) Default status: unaffected	CVE List	Version 2022	affected
		Version 2023	affected
		Version 2024	affected
		Version 2024 R2	affected
EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Browse Schneider Electric / EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Default status: unaffected	CVE List	Version 2022 w/ Advanced Reporting Module	affected
	CVE List	Version 2024 w/ Advanced Reporting Module	affected

References

download.schneider-electric.com

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-54924