PT-2025-11093 · Schneider Electric · Ecostruxure Power Automation System User Interface

Published 2025-03-11 · Updated 2025-03-12 · CVE-2025-0813

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: EcoStruxure Power Automation System User Interface (EPAS-UI) (affected versions not specified)

Description: The issue is related to insufficient authentication procedure in the EcoStruxure Power Automation System User Interface (EPAS-UI), which could allow an attacker to impact the confidentiality, integrity, and availability of protected information. An unauthorized user with physical access to the EPAS-UI computer may be able to bypass authentication by rebooting the workstation and interrupting the normal boot process.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2025-02566

CVE-2025-0813

Affected Products

Ecostruxure Power Automation System User Interface

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-0813 · Security Note
• https://bdu.fstec.ru/vul/2025-02566 · Security Note
• https://twitter.com/CVEnew/status/1899894903813136461 · Twitter Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-02.pdf · Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-070-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-070-02.pdf · Note