Low severity · published Aug 20, 2025
CVE-2025-8448
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able…
1.0
CVSS
0.2%
EPSS
No
On KEV
Description
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EB
EcoStruxure Building Operation Enterprise Server · Schneider Eelctric
All 7.x versions before 7.0.2.348; All 6.x versions before 6.0.4.10001 (CP8); All 5.x versions before 5.0.3.17009 (CP16) · source: vendor
EB
EcoStruxure Building Operation Workstation · Schneider Eelctric
All 7.x versions before 7.0.2.348; All 6.x versions before 6.0.4.10001 (CP8); All 5.x versions before 5.0.3.17009 (CP16) · source: vendor
EE
EcoStruxure Enterprise Server · Schneider Electric
All 7.x versions before 7.0.2.348; All 6.x versions before 6.0.4.10001 (CP8); All 5.x versions before 5.0.3.17009 (CP16) · source: vendor
Affected product
EB
EcoStruxure Building Operation Enterprise Server
Schneider Eelctric