CVE-2025-2002 Schneider Electric CVE debrief

Who should care

Administrators and operators of Schneider Electric EcoStruxure Panel Server deployments, especially OT/ICS environments where debug mode may be used and debug exports are collected for support or troubleshooting. Security teams responsible for device hardening, credential management, and firmware updates should also prioritize review.

Technical summary

The source advisory maps this issue to CWE-532, insertion of sensitive information into log files. Affected product coverage in the CSAF entry is Schneider Electric EcoStruxure Panel Server version v2.0 and prior. The exposure condition described by the vendor and CISA involves FTP server deployment plus administrative use of debug mode and export of debug files, which can reveal FTP credentials. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, indicating local access, high privileges, and confidentiality impact.

Defensive priority

Medium. The issue requires privileged administrative actions and specific device conditions, but the disclosed impact is sensitive credential exposure in an industrial product. Apply the vendor fix where possible, and otherwise disable debug mode as recommended by the advisory.

Recommended defensive actions

• Upgrade EcoStruxure Panel Server firmware to version v2.1 or later.
• Upgrade EcoStruxure Power Commission software to version 2.33.0 or later as part of the remediation path.
• If remediation cannot be applied immediately, ensure debug mode is turned off to prevent credential exposure.
• Review any exported debug files for possible disclosure of FTP credentials and handle them as sensitive artifacts.
• Follow CISA industrial control system recommended practices for defense-in-depth and device hardening.

Evidence notes

This debrief is based only on the supplied CISA CSAF advisory ICSA-25-077-04 and the Schneider Electric security notice references in the source corpus. The advisory states: 'CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device.' The CSAF identifies Schneider Electric EcoStruxure Panel Server version v2.0 and prior as affected and lists v2.1 or later as the fix.

Official resources