CVE-2025-11565: Path Traversal Vulnerability

CVE-2025-11565 Overview

CVE-2025-11565 is a path traversal vulnerability [CWE-22] affecting a Schneider Electric product exposing a Web Admin interface. The flaw resides in the POST /REST/UpdateJRE endpoint. An authenticated Web Admin user on the local network can tamper with the request payload to traverse outside the intended directory. Successful exploitation results in elevated system access on the host running the affected service. The issue is documented in Schneider Electric advisory SEVD-2025-315-01.

Critical Impact
An authenticated local-network attacker with Web Admin privileges can manipulate the UpdateJRE request to write or reference files outside the intended path, gaining elevated access to the underlying system.

Affected Products

Schneider Electric product referenced in advisory SEVD-2025-315-01 (Web Admin component exposing /REST/UpdateJRE)
Specific product name and versions: Not Available in NVD data — consult the Schneider Electric Security Notice

Discovery Timeline

2025-11-12 - CVE-2025-11565 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11565

Vulnerability Analysis

The vulnerability is a path traversal issue [CWE-22] in a REST endpoint responsible for updating the Java Runtime Environment on the affected Schneider Electric device. The endpoint accepts a payload via POST /REST/UpdateJRE that references a file or path used during the update process. Insufficient validation of that path allows a Web Admin user to supply traversal sequences that resolve outside the intended directory. The service processes those paths with elevated privileges, so referenced files can be executed, replaced, or written under the service account. The result is elevated system access from an account that was intended to be scoped to administrative UI actions only.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. Input from the UpdateJRE request payload is used to build file system paths without canonicalization or allow-list validation. Sequences such as ../ are not stripped or rejected before the path is passed to update routines that run with higher privileges than the Web Admin role.

Attack Vector

Exploitation requires local-network access and valid Web Admin credentials. An attacker authenticates to the Web Admin interface and sends a crafted POST /REST/UpdateJRE request containing a manipulated file path. The high attack complexity reflected in the CVSS vector suggests conditions such as timing, path layout, or specific payload structure must be met. Remote unauthenticated exploitation is not possible.

No verified proof-of-concept code is publicly available for CVE-2025-11565.
Refer to Schneider Electric advisory SEVD-2025-315-01 for technical detail.

Detection Methods for CVE-2025-11565

Indicators of Compromise

HTTP POST requests to /REST/UpdateJRE originating from the local network, especially from hosts not associated with normal administration workflows.
Request payloads to UpdateJRE containing path traversal sequences such as ../, ..\, URL-encoded %2e%2e%2f, or absolute paths outside the JRE update directory.
Unexpected file writes, replacements, or new executables under system directories immediately following an UpdateJRE call.

Detection Strategies

Inspect Web Admin access logs for UpdateJRE invocations and correlate with the authenticated user, source IP, and payload contents.
Alert on any deviation from the expected JRE update file path in UpdateJRE request bodies.
Baseline normal update cadence and flag off-hours or high-frequency UpdateJRE calls.

Monitoring Recommendations

Forward Web Admin application logs and host file-integrity events to a central SIEM for correlation.
Monitor privileged file-system changes on the host running the affected service, especially outside the intended JRE directory.
Track authentication events for Web Admin accounts and alert on new or unusual administrative sessions on the operational technology network.

How to Mitigate CVE-2025-11565

Immediate Actions Required

Apply the remediation described in Schneider Electric advisory SEVD-2025-315-01 as soon as it is available for your product and version.
Restrict network access to the Web Admin interface to a dedicated administration VLAN or jump host.
Rotate Web Admin credentials and enforce unique, strong passwords for every administrator.
Audit existing Web Admin accounts and remove any that are unused or over-privileged.

Patch Information

Schneider Electric has published guidance in SEVD-2025-315-01. Consult that advisory for the affected product versions and fixed builds, and follow the vendor's documented update procedure for the target device.

Workarounds

Place the affected device behind a firewall that only permits management traffic from designated administrator hosts.
Disable or block external access to the /REST/UpdateJRE endpoint at a reverse proxy or web application firewall until the patch is applied.
Require multi-factor authentication or a bastion host for any access to the Web Admin interface.
Log and review every UpdateJRE invocation until the fix is deployed.

bash

# Example ACL: restrict UpdateJRE to a single admin host
# (adapt to your reverse proxy or firewall product)
location = /REST/UpdateJRE {
    allow 10.10.20.5;   # authorized admin workstation
    deny  all;
}