CVE-2025-0327: Privilege Escalation Vulnerability

CVE-2025-0327 Overview

CVE-2025-0327 is an improper privilege management vulnerability [CWE-269] affecting two Windows services on a Schneider Electric engineering workstation. One service manages audit trail data while the other acts as a server handling client requests. A local attacker with standard user privileges can modify the executable path of these Windows services. When the services restart, the attacker-controlled binary executes with elevated privileges, resulting in loss of confidentiality, integrity, and availability of the engineering workstation.

Critical Impact
A standard user can escalate to service-level privileges by altering the service executable path, gaining full control of the engineering workstation once the affected services are restarted.

Affected Products

Schneider Electric engineering workstation software (see vendor advisory SEVD-2025-042-03 for the exact product and version list)
Windows service managing audit trail data on the affected workstation
Windows service acting as the server managing client requests on the affected workstation

Discovery Timeline

2025-02-13 - CVE-2025-0327 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-0327

Vulnerability Analysis

The flaw is a local privilege escalation weakness rooted in insecure Windows service configuration. Two services on the engineering workstation are installed with access control descriptors that permit non-privileged users to modify service properties, including the ImagePath value that defines the executable a service launches at start.

An attacker holding only standard user rights can point the service to an arbitrary binary. The next time the service starts, Windows Service Control Manager (SCM) launches the attacker binary under the service account, typically LocalSystem or an equivalent high-privilege context. This grants full read, write, and execute control over the workstation and the industrial engineering data it holds.

Because exploitation requires the services to be restarted, an attacker may either wait for a scheduled reboot or trigger a restart through legitimate means available to a standard user.

Root Cause

The root cause is improper privilege management on the two Windows services. Their security descriptors grant SERVICE_CHANGE_CONFIG (or equivalent write access) to standard users. This violates the principle of least privilege, allowing low-privileged accounts to alter service binaries executed by high-privileged accounts.

Attack Vector

The attack vector is local. The attacker must already have interactive or authenticated standard-user access to the engineering workstation. Exploitation follows a well-known Windows service hijacking pattern: enumerate services with weak permissions, rewrite the service ImagePath to a malicious executable, then wait for or induce a service restart.

Refer to the Schneider Electric Security Notice SEVD-2025-042-03 for technical specifics on the affected services.

Detection Methods for CVE-2025-0327

Indicators of Compromise

Unexpected modification of the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName> for the affected audit trail and client-request server services.
Service binaries running from non-standard directories such as user profile paths, C:\Users\Public, or temporary folders.
Windows Service Control Manager events showing service configuration changes initiated by non-administrative accounts.

Detection Strategies

Monitor Windows Event ID 7040 (service configuration change) and Event ID 4670 (permissions on an object changed) for the audit trail and client-request services.
Baseline the ImagePath values of all Schneider Electric services and alert on any deviation from the vendor-installed path.
Track process creation events (Sysmon Event ID 1) where a Schneider Electric service starts a child process outside its known execution profile.

Monitoring Recommendations

Enable auditing of registry writes to service subkeys and forward the logs to a centralized SIEM for correlation.
Alert when standard users invoke sc.exe config, Set-Service, or the ChangeServiceConfig API against engineering workstation services.
Review service restart events on OT engineering workstations and correlate them with preceding configuration changes.

How to Mitigate CVE-2025-0327

Immediate Actions Required

Apply the remediation described in Schneider Electric advisory SEVD-2025-042-03 on all affected engineering workstations.
Audit and harden the discretionary access control lists (DACLs) on the two affected Windows services so that only administrators hold SERVICE_CHANGE_CONFIG rights.
Restrict interactive logon on engineering workstations to trusted engineering personnel and remove local standard-user accounts that do not require access.

Patch Information

Schneider Electric has published remediation guidance in Security Notice SEVD-2025-042-03. Consult the notice for the fixed version numbers, remediation steps, and any compensating controls specific to your deployment.

Workarounds

Manually reset the service security descriptors using sc.exe sdset to remove write permissions granted to non-administrative users.
Enforce application allowlisting (for example, Windows Defender Application Control or AppLocker) so that only signed, vendor-approved binaries can execute as service processes.
Segment engineering workstations on a dedicated OT network zone with strict jump-host access controls to reduce the pool of users who can attempt local exploitation.

bash

# Example: query and harden a Windows service security descriptor
# 1. Inspect current DACL on the affected service
sc.exe sdshow <ServiceName>

# 2. Apply a hardened SDDL removing write access from non-administrators
#    (adjust to match your environment and vendor guidance)
sc.exe sdset <ServiceName> "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)"

# 3. Verify the ImagePath still points to the vendor-installed binary
reg query "HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>" /v ImagePath