# Schneider Electric EcoStruxure DoS and credential disclosure

Published: 2025-09-11 · Severity: routine · Sectors: manufacturing, energy
Canonical: https://vorant.io/reports/f04a02d4-d230-52b8-849d-397c189a42f3/schneider-electric-ecostruxure-dos-and-credential-disclosure

> Adjacent network attackers can cause DoS or steal credentials from EcoStruxure building management systems; no public exploitation known yet.

Schneider Electric has issued a security advisory addressing two vulnerabilities affecting EcoStruxure Building Operation Enterprise Server, Enterprise Server, and Workstation products across versions 5.x, 6.x, and 7.x. CVE-2025-8449 is an uncontrolled resource consumption flaw (CWE-400) that allows an authenticated user within the building management system network to send a specially crafted request to a specific endpoint, causing a denial-of-service condition. CVE-2025-8448 is an exposure of sensitive credential data (CWE-200) that permits attackers positioned on the same network segment to capture local SMB traffic and extract sensitive authentication data. Both vulnerabilities require adjacent network access and a degree of authentication or timing, lowering exploitability from the internet but making them relevant to insider threats or compromised network positions. The vulnerabilities affect critical infrastructure operators in manufacturing and energy sectors worldwide. Schneider Electric has released patched versions (7.0.2.348, 6.0.4.10001 CP8, and 5.0.3.17009 CP16) and recommends immediate patching. No public exploitation has been reported to CISA as of the advisory date.

## Mentioned in this report

- Vulnerabilities: CVE-2025-8448, CVE-2025-8449

## Detection guidance (public sample)

### Packet Capture Tool Executed With SMB-Focused Filter

ATT&CK: T1040

Detects packet capture utilities (tshark, dumpcap, windump, tcpdump) launched with SMB/port 445 filters, consistent with sniffing local SMB traffic to extract authentication data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Packet Capture Tool Executed With SMB-Focused Filter
description: Detects packet capture utilities (tshark, dumpcap, windump, tcpdump)
  run with SMB or TCP port 445 filters. This matches the behaviour of an adjacent-network
  attacker capturing SMB traffic to extract credential material (as in CVE-2025-8448
  scenarios).
tags:
- attack.credential-access
- attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \\tshark.exe
    - \\dumpcap.exe
    - \\windump.exe
    - \\tcpdump.exe
  selection_smb:
    CommandLine|contains:
    - port 445
    - tcp.port==445
    - tcp.port == 445
    - smb
  condition: selection_img and selection_smb
falsepositives:
- Network engineers troubleshooting SMB performance or connectivity with Wireshark
  command-line tools
- Authorised security assessments or packet-capture based monitoring agents
level: medium
id: dd559818-bb11-59f4-9384-0fedb16e2f87
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-08
```

### Built-in Windows Packet Capture Started via Netsh or Pktmon

ATT&CK: T1040

Detects use of native Windows tooling (netsh trace with capture=yes, pktmon start with capture) to sniff network traffic without dropping third-party sniffers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Built-in Windows Packet Capture Started via Netsh or Pktmon
description: Detects native Windows packet capture being started via netsh trace start
  capture=yes or pktmon start --capture. Attackers on an adjacent network segment
  can use these living-off-the-land capabilities to collect SMB traffic and recover
  authentication data.
tags:
- attack.credential-access
- attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_netsh:
    Image|endswith: \\netsh.exe
    CommandLine|contains|all:
    - trace
    - start
    - capture=yes
  selection_pktmon:
    Image|endswith: \\pktmon.exe
    CommandLine|contains|all:
    - start
    - capture
  condition: 1 of selection_*
falsepositives:
- Administrators collecting network traces for troubleshooting with netsh trace or
  pktmon
- Vendor support sessions that request a network trace
level: medium
id: 733c279e-bd1e-5d3c-a365-38e8e98e6610
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-08
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-08

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f04a02d4-d230-52b8-849d-397c189a42f3/schneider-electric-ecostruxure-dos-and-credential-disclosure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup