CVE-2025-11739
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated a…
Published Mar 10, 2026 · updated Jun 24, 2026 · schneider-electric ecostruxure power monitoring expert
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 10, 2026 · NIST NVD
Detected
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
Jun 24, 2026 · NIST NVD
Updated
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
Affected
- cpe schneider-electric/ecostruxure power monitoring expert2022
- cpe schneider-electric/ecostruxure power monitoring expert2023
- cpe schneider-electric/ecostruxure power monitoring expert2024
- cpe schneider-electric/ecostruxure power operation2022
- cpe schneider-electric/ecostruxure power operation2024
Sources
- CVE.orgVulnerability recordCVE-2025-11739
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2025-11739
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
nvd.nist.gov