SB20250422101 - Multiple vulnerabilities in Schneider Electric ConneXium Network Manager

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Files or Directories Accessible to External Parties (CVE-ID: CVE-2025-2222)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the files or directories accessible to external parties. A remote attacker can gain access to sensitive information on the system.

2) Input validation error (CVE-ID: CVE-2025-2223)

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick a victim to open a specially crafted project file and execute arbitrary code on the system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-098-01.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-03