CVE-2025-7746
Medium
Description
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.
SeverityMedium
CVSS5.3
Exploit probability—
ProductATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives
PublishedSep 9, 2025
First seenSep 9, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Schneider Electric VW3A3530D: ATVdPAC modulev25.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Schneider Electric ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives | No range specified | — |
| Schneider Electric ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drives | No range specified | — |
| Schneider Electric ILC992 InterLink Converter | No range specified | — |
| Schneider Electric ATV340E Altivar Machine Drives | No range specified | — |
| Schneider Electric ATV6000 Medium Voltage Altivar Process Drives | No range specified | — |
| Schneider Electric ATS490 Altivar Soft Starter | No range specified | — |
| Schneider Electric VW3A3720 & VW3A3721 Altivar Process Communication Modules | No range specified | — |
| Schneider Electric VW3A3530D: ATVdPAC module | v < v25.0 | v25.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.