CVE-2025-50121
Published: 11 July 2025
Summary
CVE-2025-50121 is a critical-severity OS Command Injection (CWE-78) vulnerability in Schneider Electric (inferred from references). Its CVSS base score is 9.5 (Critical).
Operationally, ranked in the top 14.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-50121 is a CWE-78 OS Command Injection vulnerability that permits unauthenticated remote code execution. The flaw resides in a web interface component that processes folder creation requests over HTTP, an interface that remains disabled by default in the affected software.
An unauthenticated attacker with network access can exploit the issue simply by submitting a malicious folder name through the HTTP web interface when it has been enabled. Successful exploitation grants the attacker full remote code execution, resulting in complete compromise of confidentiality, integrity, and availability on the target system.
The vendor advisory SEVD-2025-189-01 and the associated full-disclosure posting outline mitigation guidance, including steps to keep the HTTP interface disabled and apply available patches. The EPSS score has remained flat at 0.026 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21128
Vulnerability details
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP is disabled…
more
by default.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.