« Volver al listado

CVE-2025-8449

Estado: AplazadaMedia (4.1)—

CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-8449",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-8449",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-20T17:10:39.552635Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cybersecurity@se.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 4.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "ADJACENT",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@se.com",
      "affectedData": [
        {
          "vendor": "Schnieder Electric",
          "product": "EcoStruxure Building Operation Enterprise Server",
          "versions": [
            {
              "status": "affected",
              "version": "All 7.x versions",
              "lessThan": "7.0.2.348",
              "versionType": "version"
            },
            {
              "status": "unaffected",
              "version": "All 6.x versions",
              "lessThan": "6.0.4.10001 (CP8)",
              "versionType": "version"
            },
            {
              "status": "affected",
              "version": "All 5.x versions",
              "lessThan": "5.0.3.17009 (CP16)",
              "versionType": "version"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Schneider Electric",
          "product": "EcoStruxure Enterprise Server",
          "versions": [
            {
              "status": "unaffected",
              "version": "All 7.x versions",
              "lessThan": "7.0.2.348",
              "versionType": "version"
            },
            {
              "status": "affected",
              "version": "All 6.x versions",
              "lessThan": "6.0.4.10001 (CP8)",
              "versionType": "version"
            },
            {
              "status": "affected",
              "version": "All 5.x versions",
              "lessThan": "5.0.3.17009 (CP16)",
              "versionType": "version"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Schneider Eelctric",
          "product": "EcoStruxure Building Operation Workstation",
          "versions": [
            {
              "status": "affected",
              "version": "All 7.x versions",
              "lessThan": "7.0.2.348",
              "versionType": "version"
            },
            {
              "status": "affected",
              "version": "All 6.x versions",
              "lessThan": "6.0.4.10001 (CP8)",
              "versionType": "version"
            },
            {
              "status": "affected",
              "version": "All 5.x versions",
              "lessThan": "5.0.3.17009 (CP16)",
              "versionType": "version"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-20T14:15:48.840",
  "references": [
    {
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-04.pdf",
      "source": "cybersecurity@se.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@se.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network."
    },
    {
      "lang": "es",
      "value": "CWE-400: Existe una vulnerabilidad de consumo descontrolado de recursos que podría provocar una denegación de servicio cuando un usuario autenticado envía una solicitud especialmente manipulada a un endpoint específico desde dentro de la red BMS."
    }
  ],
  "lastModified": "2026-06-17T10:07:00.603",
  "sourceIdentifier": "cybersecurity@se.com"
}