CVE-2025-6438

🗓️ 11 Jul 2025 09:06:32Reported by schneiderType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 26 Views🌐 WEB

CVE-2025-6438 vulnerability allows XML external entity injection via SOAP API, risking unauthorized access.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-6438	10 Jul 202501:48	–	circl
CNNVD	Schneider Electric EcoStruxure IT Data Center Expert 代码问题漏洞	11 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-6438	11 Jul 202509:06	–	cvelist
EUVD	EUVD-2025-21129	3 Oct 202520:07	–	euvd
KoreLogic Security	Schneider Electric EcoStruxure IT Data Center Expert XML External Entities Injection	9 Jul 202500:00	–	korelogic
NCSC	Vulnerabilities fixed in Schneider Electric EcoStruxture IT Datacenter Expert	9 Jul 202508:38	–	ncsc
NVD	CVE-2025-6438	11 Jul 202509:15	–	nvd
Packet Storm	📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 XML Injection	10 Jul 202500:00	–	packetstorm
Positive Technologies	PT-2025-29222 · Schneider Electric · Ecostruxure Data Center Expert	11 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-6438	13 Jul 202509:22	–	redhatcve

[
  {
    "defaultStatus": "unaffected",
    "product": "EcoStruxure™ IT Data Center Expert",
    "vendor": "Schneider Electric",
    "versions": [
      {
        "lessThanOrEqual": "Prior to",
        "status": "affected",
        "version": "8.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
download	www.download.schneider-electric.com/files
seclists	www.seclists.org/fulldisclosure/2025/Jul/5

Parameter	Position	Path	Description	CWE
Id	request body	/DataExchange/DataExchangeService	XML External Entity Injection via the DataExchange SOAP endpoint allowing local file read, SSRF, and resource exhaustion.	CWE-611

15 Apr 2026 00:35Current

6.6Medium risk

Vulners AI Score6.6

CVSS 45.9

EPSS0.00257

SSVC

CWE-611