CVE-2025-6438 Schneider Electric CVE debrief

Who should care

Operators and administrators of Schneider Electric EcoStruxure™ IT Data Center Expert, especially environments running version 8.3 or earlier. Security teams responsible for externally reachable or broadly accessible management systems should also prioritize review.

Technical summary

The supplied advisory data describes an improper restriction of XML External Entity references in EcoStruxure™ IT Data Center Expert. The affected scope is version 8.3 and prior. The issue may allow manipulation of SOAP API calls and XXE injection, resulting in unauthorized file access. The advisory lists CVSS v3.1 as 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), indicating network reachability and meaningful confidentiality impact, with no integrity or availability impact stated in the provided vector.

Defensive priority

Medium; prioritize to high for any deployment exposed to untrusted network access or relying on application accounts with elevated access.

Recommended defensive actions

• Upgrade EcoStruxure™ IT Data Center Expert to version 9.0, which Schneider Electric says includes the fix.
• If you cannot remediate immediately, follow Schneider Electric's EcoStruxure™ IT Data Center Expert Security Handbook and the vendor/CISA hardening guidance referenced in the advisory.
• Review where SOAP API access is allowed and restrict access to trusted administrative networks and accounts.
• Audit application accounts used by the server and remove unnecessary privileges where possible.
• Validate that affected instances are identified and tracked so version 8.3 and earlier do not remain in production unnoticed.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory ICSA-25-203-06, Schneider Electric's linked Security and Safety Notice SEVD-2025-189-01, and the provided source metadata. The advisory explicitly names EcoStruxure™ IT Data Center Expert version 8.3 and prior as affected, describes the flaw as CWE-611/XXE affecting SOAP API calls, and states that unauthorized file access may occur. The provided CVSS vector is 6.8/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. No KEV entry is present in the supplied enrichment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.