Medium severity · published Jul 11, 2025
CVE-2025-6788
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with…
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources
to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML
diagrams.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
EcoStruxure™ Power Monitoring Expert · Schneider Electric
2023 before All; 2023 R2 before All; 2024 before All; 2024 R2 before All · source: vendor
EP
EcoStruxure™ Power Operation Advanced Reporting and Dashboards Module · Schneider Electric
2022 w/ Advanced Reporting Module before All; 2024 w/ Advanced Reporting Module before All · source: vendor
Affected product
EP
EcoStruxure™ Power Monitoring Expert
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6788
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6788
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-04.pdf
More from EcoStruxure™ Power Monitoring Expert
9.8
CVE-2023-5391
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted…
8.8
CVE-2023-28003
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate…
8.8
CVE-2022-22727
A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or…
8.8
CVE-2021-22827
A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload
8.8
CVE-2021-22826
A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload