IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2025-098-01 — ConneXium Network Manager Software

HIGH
CVSS 7.8
Date 2026-10-16T20:32:09+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification > 08-Apr-25 (13-May-25) Document Reference Number – SEVD-2025-098-01 (v1.1.0) Page 1 of 4 > Public ## ConneXium Network Manager Software 8 April 2025 (13 May 2025) ## Overview Schneider Electric is aware of vulnerabilities in its ConneXium Network Manager software. The ConneXium Network Manager software provides a solution for configuring and monitoring the administrable Schneider Electric devices, including switches, routers, firewalls, ConneXium Wi-Fi devices, and products from various manufacturers. Failure to apply the mitigations below may risk sensitive data disclosure, leading privilege escalation through man-in-the-middle attacks on ConneXion Network Manager, denial of service, and remote code execution on engineering workstations. May 2025 Update : The CVSS v3.1 vector string was updated. ## Affected Products and Versions Product CVE-2025-2222 CVE-2025-2223 ConneXium Network Manager Version V2.0.01 All versions ## Vulnerability Details CVE ID: CVE-2025-2222 CVSS v3.1 Base Score 7.5 | High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v4.0 Base Score 8.2 | High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privilege escalation following man in the middle attack. CVE ID: CVE-2025-2223 CVSS v3.1 Base Score 7.8 | High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS v4.0 Base Score 8.4 | High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a malicious project file is loaded by a user from the local system. Schneider Electric Security Notification > 08-Apr-25 (13-May-25) Document Reference Number – SEVD-2025-098-01 (v1.1.0) Page 2 of 4 > Public

// Vulnerabilities (2)

CVE ID CVSS Score Severity Description
CVE-2025-2223 7.8 high
CVE-2025-2223. CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a malicious project file is loaded by a user from the local system.
CVE-2025-2222 7.8 high
CVE-2025-2222. CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privilege escalation following man in the middle attack.

// Remediations (1)

Mitigation: Please note that the ConneXium Network Manager product has reached the end of its life and is no lon
Please note that the ConneXium Network Manager product has reached the end of its life and is no longer supported. Customers should immediately apply the following mitigations to reduce the risk of exploit: • Only open project files received from a trusted source. • Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage. • Encrypt project file when stored and restrict the access to only trusted users. • When exchanging files over the network, use secure communication protocols. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices available for download here: https://www.se.com/ww/en/download/document/7EN52-0390/

// References