CVE-2025-7746: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user…

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 37% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AA

ATS490 Altivar Soft Starter · Schneider Electric

all versions · source: vendor

AA

ATV340E Altivar Machine Drives · Schneider Electric

all versions · source: vendor

AM

ATV6000 Medium Voltage Altivar Process Drives · Schneider Electric

all versions · source: vendor

AA

ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives · Schneider Electric

all versions · source: vendor

AA

ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drives · Schneider Electric

all versions · source: vendor

II

ILC992 InterLink Converter · Schneider Electric

all versions · source: vendor

VA

VW3A3530D: ATVdPAC module · Schneider Electric

all versions before v25.0 · source: vendor

VV

VW3A3720 & VW3A3721 Altivar Process Communication Modules · Schneider Electric

all versions · source: vendor