CVE-2025-11567: Privilege Escalation Vulnerability

CVE-2025-11567 Overview

CVE-2025-11567 is an Incorrect Default Permissions vulnerability [CWE-276] disclosed in a Schneider Electric product. The flaw exists when the target installation folder is not properly secured, allowing a local authenticated attacker with low privileges to gain elevated system access. Because the installation directory inherits weak access control lists, a low-privileged user can modify files that execute in a higher-privileged context. Successful exploitation results in a full compromise of confidentiality, integrity, and availability on the affected host.

Critical Impact
A local attacker with low privileges can escalate to elevated system access by tampering with files inside an insecurely permissioned installation folder.

Affected Products

Schneider Electric software product (see vendor advisory SEVD-2025-315-01 for the affected product and version list)
Installations where default folder permissions on the target directory were not hardened
Windows hosts running the vulnerable installation under a privileged service context

Discovery Timeline

2025-11-12 - CVE-2025-11567 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11567

Vulnerability Analysis

The vulnerability stems from Incorrect Default Permissions [CWE-276] applied to the product's installation folder. When the installer provisions the target directory, it does not enforce restrictive access control lists on directory contents. Standard local users therefore inherit write or modify permissions on files that execute in a higher-privileged security context.

An attacker who already has a low-privileged local session can replace or modify executables, libraries, or configuration files inside the installation directory. When a privileged service, scheduled task, or administrator subsequently loads those files, the attacker's payload runs with elevated privileges. The vendor advisory documents the affected products and fixed versions in SEVD-2025-315-01.

Root Cause

The root cause is a permissions misconfiguration set at installation time. The installer fails to apply least-privilege discretionary access control lists (DACLs) to the target folder. As a result, non-administrative principals inherit modify rights on binaries and resources that run under a privileged account.

Attack Vector

Exploitation requires local access and low-level privileges on the host. No user interaction is required from a victim, but the attack does depend on a specific precondition: the installation folder must retain the insecure default permissions. The attacker plants a malicious binary or overwrites a legitimate one in the installation path, then waits for a privileged process to load it.

Detailed exploitation steps and the vendor's remediation guidance are documented in the Schneider Electric Security Notice SEVD-2025-315-01.

Detection Methods for CVE-2025-11567

Indicators of Compromise

Unexpected writes or file replacements inside the product's installation directory by non-administrative user accounts
New or modified executables, DLLs, or configuration files under the installation path with timestamps that do not match a legitimate installer or update event
Privileged services or scheduled tasks loading modules from paths that were recently modified by standard users

Detection Strategies

Audit the DACLs on the installation folder and compare against a hardened baseline; flag any entries granting write, modify, or full control to non-administrative principals.
Enable Windows object access auditing (Event IDs 4663 and 4670) on the installation directory to record file modifications and permission changes.
Correlate file modification events with subsequent process creation events (Event ID 4688) where the parent runs under SYSTEM or another privileged account.

Monitoring Recommendations

Alert on any process spawned from the installation directory that runs under a security context different from the user that last wrote the binary.
Monitor for use of icacls, takeown, or PowerShell Set-Acl targeting the installation path from non-administrative sessions.
Track service restarts and scheduled task executions that follow file writes inside the installation folder within a short time window.

How to Mitigate CVE-2025-11567

Immediate Actions Required

Apply the vendor-supplied fix referenced in SEVD-2025-315-01 as soon as it is available for your product version.
Inventory all hosts running the affected Schneider Electric product and identify installations that used default folder locations.
Restrict interactive and remote local logon rights on affected hosts to reduce the pool of accounts that can stage the attack.

Patch Information

Schneider Electric documents the fixed versions and remediation steps in the Schneider Electric Security Notice SEVD-2025-315-01. Administrators should follow the vendor's upgrade path and verify that the installer applies hardened permissions on new deployments.

Workarounds

Manually harden the installation folder ACLs so that only administrators and SYSTEM hold write or modify rights; remove inherited permissions granted to Users or Authenticated Users.
Relocate the installation to a directory under %ProgramFiles% where default ACLs restrict standard user write access, if the product supports it.
Enforce application allowlisting so that only approved, signed binaries can execute from the installation path.

bash

# Configuration example: harden installation folder permissions on Windows
icacls "C:\Path\To\Vendor\Install" /inheritance:r
icacls "C:\Path\To\Vendor\Install" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
icacls "C:\Path\To\Vendor\Install" /remove "Authenticated Users" "Everyone"