1.0
Low
CVE-2025-8448 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized…
Description
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EcoStruxure Building Operation Enterprise Server 7.0 | earliest → < 7.0.2.348 | 7.0.2.348 |
| EcoStruxure Enterprise Server 7.0 | earliest → < 7.0.2.348 | 7.0.2.348 |
| EcoStruxure Building Operation Workstation 7.0 | earliest → < 7.0.2.348 | 7.0.2.348 |