CVE-2025-13905: Privilege Escalation via Incorrect Permissions

CVE-2025-13905 Overview

CVE-2025-13905 is an incorrect default permissions vulnerability [CWE-276] affecting a Schneider Electric product. A local user with normal privileges can modify one or more executable service binaries within the installation folder. When the service restarts, the tampered binary executes in the security context of the service account, enabling privilege escalation through a reverse shell.

The flaw stems from overly permissive filesystem access control lists (ACLs) applied to service binaries during installation. Exploitation requires local access and some user interaction, but attack complexity is low.

Critical Impact
A low-privileged local user can gain elevated privileges by overwriting service binaries and triggering a service restart, resulting in code execution as the service account.

Affected Products

Schneider Electric product identified in advisory SEVD-2026-013-02
Refer to the vendor advisory for the complete list of affected versions
See the Schneider Electric Security Notice for exact SKUs

Discovery Timeline

2026-01-29 - CVE-2025-13905 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13905

Vulnerability Analysis

The vulnerability originates in the installation routine, which places executable service binaries in a directory whose ACLs grant write or modify permissions to non-privileged local users. Because the affected binaries are executed by a service running under an elevated account, any user-controlled modification to those binaries becomes privileged code at the next service start.

The attack chain is direct. An authenticated local user overwrites a service executable with a malicious payload, then waits for or triggers a service restart. On restart, the Service Control Manager launches the attacker-controlled binary under the service's identity, typically LocalSystem or an equivalent high-privilege principal. A reverse shell payload then provides interactive control at the elevated privilege level.

This class of flaw is commonly categorized as insecure file permissions leading to local privilege escalation. It does not require memory corruption, exploit primitives, or authentication bypass. Standard filesystem operations available to any interactive user are sufficient.

Root Cause

The root cause is incorrect default permissions on the installation folder and its executable contents. The installer fails to restrict write access to administrative principals, leaving service binaries modifiable by members of common groups such as Users or Authenticated Users.

Attack Vector

The attack vector is local. A user with valid credentials on the target host identifies a writable service binary within the installation directory, replaces it with a malicious executable that opens a reverse shell, and induces a service restart through system reboot, service manager interaction, or waiting for a scheduled restart. The replaced binary executes with the service account's privileges.

No verified public exploit code is available. The vulnerability mechanism is described in the Schneider Electric Security Notice.

Detection Methods for CVE-2025-13905

Indicators of Compromise

Modification timestamps on service executables in the affected installation folder that do not correspond to an official vendor update or patch
Unexpected outbound network connections initiated by the service process shortly after service start
New or altered file hashes for service binaries compared to the vendor-signed baseline
Service crashes or restarts followed by anomalous child processes such as cmd.exe, powershell.exe, or shell interpreters

Detection Strategies

Monitor file integrity on the installation directory and alert on any write to executables by non-administrative accounts
Correlate service restart events (Windows Event ID 7036) with recent file writes to service binary paths
Baseline expected child processes for the affected service and alert on deviations, particularly shell or scripting hosts
Inspect ACLs on the installation folder and flag hosts where non-privileged principals hold write permissions on executables

Monitoring Recommendations

Enable Windows object access auditing on the installation directory to capture write and modify operations
Forward EDR process telemetry and file modification events to a centralized data lake for correlation
Alert on reverse shell indicators such as outbound TCP connections from service processes to non-corporate IP ranges

How to Mitigate CVE-2025-13905

Immediate Actions Required

Apply the vendor patch referenced in Schneider Electric advisory SEVD-2026-013-02 as soon as it is available in your environment
Audit the installation folder ACLs and remove write and modify permissions for non-administrative groups
Restrict interactive local logon on hosts running the affected service to trusted administrative users
Verify the integrity of existing service binaries against vendor-provided hashes before the next service restart

Patch Information

Refer to the Schneider Electric Security Notice for patched versions, remediation steps, and product-specific guidance. Apply the update following Schneider Electric's recommended deployment procedure for industrial environments.

Workarounds

Manually reset ACLs on the installation folder so that only Administrators and SYSTEM retain write and modify rights, while standard users receive read and execute only
Configure application allowlisting to permit only signed, vendor-approved binaries to execute from the installation path
Segment affected hosts on isolated networks to constrain the impact of a successful local privilege escalation
Reduce the number of accounts with interactive logon rights on affected systems until the patch is deployed

bash

# Example: harden ACLs on a Windows service installation folder
# Replace C:\Program Files\Vendor\Product with the actual install path
icacls "C:\Program Files\Vendor\Product" /inheritance:r
icacls "C:\Program Files\Vendor\Product" /grant:r "Administrators:(OI)(CI)F"
icacls "C:\Program Files\Vendor\Product" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\Vendor\Product" /grant:r "Users:(OI)(CI)RX"