CVE-2025-6788

mediumpriority · track · 0EPSS 0.003 · 25 %ileEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.33% (25th) EPSS
CVSS 4.3 · medium
Is it mine?
31 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML diagrams.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedEcoStruxure™ Power Monitoring Expert (PME)cisa_csaf_ot

    Hotfix_199767 is available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.

  • FixedEcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Modulecisa_csaf_ot

    Hotfix_199767 available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.

  • MitigationEcoStruxure™ Power Monitoring Expert (PME)cisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: • We recommend you remove your TGML diagrams from your multitenant managed system or onpremises system and revert to using Vista diagrams.

  • MitigationEcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Modulecisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: • We recommend you remove your TGML diagrams from your multitenant managed system or onpremises system and revert to using Vista diagrams.

02

cvss

Technical severity, 0–10. One row per scoring source.

5.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.3–5.3

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US
v3.14.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU
v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cybersecurity@se.com
v4.01.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-668USCWE-668USCWE-668US
05

affected products (31)

Products and version ranges known to be affected.

showing 20 of 31
06

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-25-203-03Schneider Electric EcoStruxure2025-07-08icsa · cisa_csaf_otUS

    Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) products. EcoStruxure™ Power Monitoring Expert (PME) https://www.se.com/us/en/product-range/65404-ecostruxure-power-monitoring-expert/#overview is an on-premises software used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. Note: There are some instances of PME being deployed in a Managed Service model. EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) https://www.se.com/us/en/product-range/65405-ecostruxure-power-operation/?parent-subcategory-id=59326966&filter=business-4-low-voltage-products-and-systems#overview are on-premises software offers that provides a single platform to monitor and control medium and lower power systems. Failure to apply the remediation provided below may risk unintended data exposure to other authenticated users on that system.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otNVDCVE.orgMITRE
published 2025-07-11modified 2026-06-17
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan