IM
IronMonkey Threat Research
‹ Back to ICS Advisories

EcoStruxure™ Panel Server

MEDIUM
CVSS 6.0
Date 2026-10-16T20:32:24+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 11-Mar-25 Document Reference Number – SEVD-2025 -070-01 Page 1 of 4 ## EcoStruxure™ Panel Server 11 March 2025 Overview Schneider Electric is aware of a vulnerability in its EcoStruxure™ Panel Server product, all models. The EcoStruxure™ Panel Server is a modular gateway with enhanced cybersecurity that provides easy and fast connections to multiple concurrent edge control or cloud applications. Failure to apply the remediations provided below may risk disclosure of sensitive information, including the disclosure of credentials. Affected Products and Versions Product Version EcoStruxure™ Panel Server v2.0 and prior Vulnerability Details CVE ID: CVE-2025-2002 CVSS v3.1 Base Score 6.0 | Medium |CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVSS v4.0 Base Score 4.0 | Medium |CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device. The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0). CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment. Schneider Electric Security Notification 11-Mar-25 Document Reference Number – SEVD-2025 -070-01 Page 2 of 4 Remediation Affected Product & Version Remediation

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2025-2002 6.0 medium
CVE-2025-2002. CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device.

// Affected Products (1)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric EcoStruxure Panel Server engineering_workstation
L3
--

// Remediations (2)

Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the f
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Ensuring that debug mode is off will prevent the credentials from being improperly exposed.
Patch: Version V2.1 or later of EcoStruxure Panel Server includes a fix for this vulnerability and is avail
Version V2.1 or later of EcoStruxure Panel Server includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/40739468-ecostruxure-panel-server/?parent-subcategory-id=4160#software-and-firmware Customers should download EcoStruxure Power Commission Software version 2.33.0 or later, and version V2.1 or later of EcoStruxure Panel Server firmware to complete the upgrade process.

// References