PT-2025-33641 · Schneider Electric · Sesu+1

Published 2025-08-12 · Updated 2025-09-24 · CVE-2025-5296

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. (affected versions not specified)

Description: An Improper Link Resolution Before File Access ('Link Following') issue exists that could allow arbitrary data to be written to protected locations. This could potentially lead to escalation of privilege, arbitrary file corruption, exposure of application and system information, or persistent denial of service when a low-privileged attacker manipulates the installation folder.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2025-10379

CVE-2025-5296

Affected Products

Sesu

Schneider Electric Software Update

References · 11

• https://bdu.fstec.ru/vul/2025-10379 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-5296 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-03.pdf · Note
• https://twitter.com/windowsforum/status/1970545594071494878 · Twitter Post
• https://twitter.com/CCBalert/status/1970842519568060887 · Twitter Post
• https://twitter.com/cracbot/status/1959209041710006516 · Twitter Post
• https://se.com/ww/en/work/support/cybersecurity/security-notifications.jsp · Note
• https://twitter.com/cracbot/status/1958846660836302872 · Twitter Post
• https://t.me/cveNotify/132631 · Telegram Post
• https://t.me/CVEtracker/30268 · Telegram Post
• https://twitter.com/CVEnew/status/1957347667107090597 · Twitter Post