Medium severity · published Aug 20, 2025
CVE-2025-8449
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific…
4.1
CVSS
0.3%
EPSS
No
On KEV
Description
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EB
EcoStruxure Building Operation Enterprise Server · Schnieder Electric
All 7.x versions before 7.0.2.348; All 5.x versions before 5.0.3.17009 (CP16) · source: vendor
EB
EcoStruxure Building Operation Workstation · Schneider Eelctric
All 7.x versions before 7.0.2.348; All 6.x versions before 6.0.4.10001 (CP8); All 5.x versions before 5.0.3.17009 (CP16) · source: vendor
EE
EcoStruxure Enterprise Server · Schneider Electric
All 6.x versions before 6.0.4.10001 (CP8); All 5.x versions before 5.0.3.17009 (CP16) · source: vendor
Affected product
EB
EcoStruxure Building Operation Workstation
Schneider Eelctric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8449
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8449
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-04.pdf
More from EcoStruxure Building Operation Workstation
1.0
CVE-2025-8448
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able…