high7.8
CVE-2025-11739
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authent…
Impact
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Schneider-Electric | Ecostruxure Power Monitoring Expert | Versions 2022, 2023, 2024 |
| Schneider-Electric | Ecostruxure Power Operation | Versions 2022, 2024 |