CVE-2025-11739
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
- Score
- CVSS 4.0 8.5 High
- Status
- Analyzed - cybersecurity@se.com
- Published
- 2026-03-10
- Last modified
- 2026-03-10
- Weaknesses
- CWE-502
Affected products
- Ecostruxure Power Monitoring Expert (Schneider-electric)
- Ecostruxure Power Operation (Schneider-electric)
- Ecostruxure Power Monitoring Expert Pme (Schneider Electric)
- Ecostruxure Power Operation Epo Advanced Reporting And Dashboards Module (Schneider Electric)
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-06&p_enDocType=Security+and+Safety+Notice&p_File_…
