CVE-2025-54927 Path traversal in EcoStruxure™ Power Monitoring Expert (PME)
Authenticated attackers can access sensitive files via path traversal in Schneider Electric EcoStruxure Power Monitoring Expert and Power Operation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54927?
CVE-2025-54927 is a medium-severity path traversal vulnerability in Schneider Electric EcoStruxure™ Power Monitoring Expert (PME), published on 20 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system.
Weakness: CWE-22
Which versions are affected by CVE-2025-54927?
How do I fix CVE-2025-54927?
No fix has been published for CVE-2025-54927 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-54927 being exploited?
There is no known exploitation of CVE-2025-54927 in the wild and no public exploit code.
Sources
Also known as GHSA-xg24-qhg2-gj63.