CVE-2025-1960 Schneider Electric CVE debrief

Who should care

OT/ICS operators, Schneider Electric WebHMI administrators, EPAS User Interface and EMO-L owners, plant security teams, integrators, and incident responders responsible for remotely reachable HMI environments.

Technical summary

CISA's CSAF advisory and Schneider Electric's notice describe an insecure-defaults condition in WebHMI version 4.1.0.0 and prior when installed with EPAS User Interface version 2.6.30.19 and prior, including the EMO-L default component. The issue is network exploitable, requires no privileges or user interaction per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and can lead to unauthorized command execution when default credentials remain unchanged. The advisory notes that the default username is not displayed correctly in the WebHMI interface, which may impede safe initial setup.

Defensive priority

Urgent immediate patching priority

Recommended defensive actions

• Apply Schneider Electric hotfix WebHMI_Fix_users_for_Standard.V1 through the Customer Care Center for affected WebHMI and EMO-L deployments.
• Verify that default username and password credentials were changed on first use; remediate any system still using defaults.
• Do not expose WebHMI to the internet; restrict access with segmentation, VPN, allowlists, and other OT network controls.
• Implement the vendor's hardening guidance and CISA ICS defense-in-depth recommendations for the affected environment.
• Monitor for unauthorized WebHMI access or command activity and coordinate with Schneider Electric support if remediation is unclear.

Evidence notes

The supplied corpus includes the CISA CSAF advisory ICSA-25-077-03 and Schneider Electric Security and Safety Notice SEVD-2025-070-03, both dated 2025-03-11. Those sources state that WebHMI version 4.1.0.0 and prior, as used with EPAS User Interface version 2.6.30.19 and prior or as a default component of EMO-L, may permit unauthorized command execution if default password credentials were not changed on first use. They also note that the default username is not displayed correctly in the WebHMI interface. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.