Main Vulnerability Database Vulnerabilities #VU114977

Server-Side Request Forgery (SSRF) in EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module and EcoStruxure Power Monitoring Expert - CVE-2025-54925

Published: September 8, 2025

Vulnerability identifier: #VU114977

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-54925

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Affected software

EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module
EcoStruxure Power Monitoring Expert

How to mitigate CVE-2025-54925

Install updates from vendor's website.

EcoStruxure Power Operation (EPO) Advanced Reporting and Dashboards Module - addressed in versions Hotfix_269476_Release_13.1, Hotfix_269509_Release_13.1
EcoStruxure Power Monitoring Expert - addressed in versions Hotfix_269476_Release_13.1, Hotfix_269509_Release_13.1

External References

Related Security Bulletins

Multiple vulnerabilities in Schneider Electric EcoStruxure Power Monitoring Expert and EcoStruxure Power Operation Advanced Reporting and Dashboards Module