CVE-2025-8449
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of...
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
- Record
CVE-2025-8449- CVSS 4.0
- 4.1 Medium
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-25280
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
- Record
EUVD-2025-25280- CVSS 4.0
- 4.1 Medium
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mwcm-qxp3-wwj9
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of...
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
- Record
GHSA-mwcm-qxp3-wwj9- CVSS 4.0
- 4.1 Medium
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
- Record
CVE-2025-8449- CVSS 4.0
- 4.1 Medium
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
- schneider eelctric ecostruxure building operation workstation
- schneider eelctric ecostruxuretm building operation enterprise server
- schneider eelctric ecostruxuretm workstation
- schneider electric ecostruxure enterprise server
- schneider electric ecostruxuretm enterprise server
- schnieder electric ecostruxure building operation enterprise server
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-8449 is a medium vulnerability (CVSS 4.1) in Schneider Eelctric Ecostruxure Building Operation Workstation, published August 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 21st percentile. No source names a fixed version.