# Schneider Electric Galaxy UPS systems SSH authentication bypass

Published: 2025-09-16 · Severity: high · Sectors: energy, manufacturing, infrastructure
Canonical: https://vorant.io/reports/d9822cf7-a88a-59c8-a6aa-bd43634a04a5/schneider-electric-galaxy-ups-systems-ssh-authentication-bypass

> Critical unauthenticated remote code execution in Schneider UPS management via SSH in Galaxy VS, VL, VXL products.

Schneider Electric Galaxy VS, VL, and VXL uninterruptible power supply (UPS) systems contain a critical missing authentication vulnerability (CVE-2025-32433) in their SSH server implementation, inherited from a flaw in Erlang/OTP libraries. The vulnerability allows an attacker to execute arbitrary commands remotely without credentials via SSH protocol message handling bypass. Affected versions are Galaxy VS prior to 6.123.0, Galaxy VL prior to 18.10.0, and Galaxy VXL prior to 15.29.0. The CVSS v3.1 score is 10.0 (maximum), reflecting network accessibility, low attack complexity, and complete system compromise potential. Galaxy UPS systems are deployed globally across commercial facilities, critical manufacturing, and energy infrastructure. No active exploitation in the wild has been reported as of the advisory date, but the combination of critical severity, ease of exploitation, and exposure in power-critical environments makes immediate patching essential. Mitigations include disabling SSH via the NMC4 web interface or network segmentation to block port 22/TCP access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-32433 (KEV)

## Detection guidance (public sample)

### PowerShell Process Initiating Outbound SSH Connection

ATT&CK: T1021.004

PowerShell (for example Posh-SSH or a scripted SSH client) opening an outbound TCP/22 connection from a Windows host. This can indicate scripted SSH access to exposed devices such as the Galaxy UPS SSH auth bypass (CVE-2025-32433). The advisory gives no host telemetry, so this is a generic proxy for scripted SSH use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell Process Initiating Outbound SSH Connection
description: Detects powershell.exe or pwsh.exe making an outbound TCP connection
  to port 22. Scripted SSH from PowerShell is uncommon on most endpoints and may indicate
  lateral movement or exploitation tooling aimed at SSH services, such as the Erlang/OTP
  SSH missing-authentication flaw (CVE-2025-32433) in Galaxy UPS. Tune by excluding
  known admin or jump hosts.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.execution
- attack.t1059.001
- attack.initial-access
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    DestinationPort: 22
    Initiated: 'true'
  filter_loopback:
    DestinationIp:
    - 127.0.0.1
    - ::1
  condition: selection and not filter_loopback
falsepositives:
- Administrators using Posh-SSH or PowerShell-based automation to manage network or
  Linux devices from admin workstations
- Configuration management or backup scripts that use SSH from PowerShell
level: low
id: dbdfd469-7a92-51d6-9793-b8a4f6a01d70
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-07
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-07

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d9822cf7-a88a-59c8-a6aa-bd43634a04a5/schneider-electric-galaxy-ups-systems-ssh-authentication-bypass.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup