CVE-2025-2222 Schneider Electric CVE debrief

Who should care

Operators and administrators who still use Schneider Electric ConneXium Network Manager v2.0.01, especially in industrial or OT environments where the product may be reachable over HTTPS or exposed on enterprise networks. Network and security teams supporting deprecated OT software should also review the mitigation guidance.

Technical summary

The source advisory attributes the issue to CWE-552 (files or directories accessible to external parties). In the provided description, access over HTTPS could leak information, and a man-in-the-middle attack could contribute to potential privilege escalation. The affected product listed in the CSAF advisory is Schneider Electric ConneXium Network Manager v2.0.01. Schneider Electric notes that the webserver is disabled by default and recommends disabling it, along with workstation, network, and site-hardening measures. The product is also stated to be end-of-life.

Defensive priority

High for any environment that still has the affected product deployed, because the product is unsupported and the issue is network-reachable with high confidentiality impact. Priority is lower only if the product is not present or is fully isolated and the webserver is already disabled, but the end-of-life status still warrants replacement planning.

Recommended defensive actions

• Confirm whether Schneider Electric ConneXium Network Manager v2.0.01 is deployed anywhere in your environment.
• Disable the webserver if it is enabled; Schneider Electric states it is disabled by default.
• Apply Schneider Electric's recommended workstation, network, and site-hardening guidance from the published security notice.
• Treat the product as end-of-life and begin migration or replacement planning.
• Review exposure of any HTTPS service associated with the product and limit access to trusted management networks only.
• Monitor the CISA and Schneider Electric advisories for any updated guidance.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-107-03 and Schneider Electric's security notice SEVD-2025-098-01, both published on 2025-04-08. The source corpus identifies one affected product, Schneider Electric ConneXium Network Manager v2.0.01, and provides the mitigation guidance noted above. No KEV listing was provided in the source corpus.

Official resources