{"id":"CVE-2025-6438","aliases":["EUVD-2025-21129","GHSA-39gj-7c5p-ccx8"],"status":"published","title":"CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...","description":"A\n\n\n\n\n\n\n\nCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could\ncause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access\nwhen the server is accessed via the network using an application account.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00453,"percentile":0.39637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2025-07-11T09:06:32Z","modified":"2026-06-17T10:01:53Z","products":[{"vendor":"schneider electric","product":"ecostruxure™ it data center expert"}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2025-189-01.pdf"},{"url":"http://seclists.org/fulldisclosure/2025/Jul/5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6438"},{"url":"https://github.com/advisories/GHSA-39gj-7c5p-ccx8"}],"sources":{"cve":[{"id":"CVE-2025-6438","description":"A\n\n\n\n\n\n\n\nCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could\ncause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access\nwhen the server is accessed via the network using an application account.","status":"published","published":"2025-07-11T09:06:32.411Z","modified":"2025-11-03T20:07:07.439Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:32:40.419293Z"}],"euvd":[{"id":"EUVD-2025-21129","description":"A\n\n\n\n\n\n\n\nCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could\ncause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access\nwhen the server is accessed via the network using an application account.","status":"published","published":"2025-07-11T09:06:32Z","modified":"2025-11-03T20:07:07Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-39gj-7c5p-ccx8","title":"CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...","description":"CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could\ncause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access\nwhen the server is accessed via the network using an application account.","status":"published","published":"2025-07-11T09:30:31Z","modified":"2025-11-03T21:35:13Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:04:25.4654Z"}],"nvd":[{"id":"CVE-2025-6438","description":"A\n\n\n\n\n\n\n\nCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could\ncause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access\nwhen the server is accessed via the network using an application account.","status":"published","published":"2025-07-11T09:15:24.987Z","modified":"2026-06-17T10:01:53.78Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:11:18.285862Z"}]}}