SB2025032128 - Multiple vulnerabilities in Schneider Electric EnerlinX IFE and eIFE

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2025-0816)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can pass specially crafted IPV6 packets to the application and perform a denial of service (DoS) attack.

2) Input validation error (CVE-ID: CVE-2025-0815)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted ICMPV6 packets to the application and perform a denial of service (DoS) attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-042-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-042-04.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-079-02