CVE-2025-5741: Charging Station Path Traversal Flaw

CVE-2025-5741 Overview

CVE-2025-5741 is a path traversal vulnerability [CWE-22] affecting a Schneider Electric charging station web server. An authenticated attacker can manipulate file path parameters to read arbitrary files outside the intended directory. The flaw stems from improper limitation of a pathname to a restricted directory, allowing traversal sequences to reach sensitive files on the device.

Critical Impact
An authenticated remote attacker can read arbitrary files from the charging station, potentially exposing configuration data, credentials, and operational information used for further compromise.

Affected Products

Schneider Electric charging station web server (see vendor advisory for specific models and firmware versions)
Refer to Schneider Electric Security Notice SEVD-2025-161-03 for the authoritative list
Not Available

Discovery Timeline

2025-06-10 - CVE-2025-5741 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5741

Vulnerability Analysis

The vulnerability resides in the charging station's web server, which accepts user-supplied input used to construct file paths. The server does not properly validate or canonicalize this input. Attackers can insert directory traversal sequences such as ../ to escape the intended root directory. The result is unauthorized read access to files stored on the underlying filesystem.

Exploitation requires an authenticated session with the web server. Once authenticated, the attacker crafts HTTP requests targeting a vulnerable endpoint that handles file references. The web server returns the contents of the requested file, including files outside its designated document root. Sensitive assets such as configuration files, log data, or credential stores become accessible through this mechanism.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The application concatenates user-controlled input into a filesystem path without normalization or allowlist validation. Traversal sequences are not stripped, and the resulting path is not verified against a permitted base directory before the file read operation executes.

Attack Vector

The attack vector is network-based over the web server's HTTP interface. High privileges are required in the form of an authenticated session, and no user interaction is needed. The impact is limited to confidentiality of files on the charging station; integrity and availability of the system are not directly affected by this issue. See the Schneider Electric Security Notice for endpoint specifics.

Detection Methods for CVE-2025-5741

Indicators of Compromise

HTTP request logs containing traversal sequences such as ../, ..%2f, or encoded variants targeting the charging station web server.
Web server access to files outside the expected document root, especially configuration files, credential stores, or system files.
Repeated file-read requests from a single authenticated session enumerating filesystem paths.

Detection Strategies

Inspect web server logs for request parameters containing directory traversal patterns and URL-encoded equivalents.
Correlate authenticated session activity with anomalous file-access patterns that deviate from normal operator workflows.
Deploy signatures on network monitoring tools to flag path traversal attempts against operational technology (OT) HTTP interfaces.

Monitoring Recommendations

Forward charging station web server logs to a centralized logging platform for retention and analysis.
Alert on any authenticated account performing high-volume file requests or accessing atypical resources on the device.
Monitor account authentication events to detect credential reuse or compromised operator sessions.

How to Mitigate CVE-2025-5741

Immediate Actions Required

Apply the firmware update published by Schneider Electric as described in SEVD-2025-161-03.
Restrict network access to the charging station web server to trusted management networks only.
Rotate credentials for any web server accounts that may have been used from untrusted networks.

Patch Information

Schneider Electric has published remediation guidance in the Schneider Electric Security Notice SEVD-2025-161-03. Consult the advisory for firmware versions, upgrade procedures, and product-specific instructions.

Workarounds

Place the charging station behind a firewall and block direct access from the internet or untrusted VLANs.
Enforce strong, unique credentials for all web server accounts and disable unused accounts to reduce the pool of authenticated attackers.
Enable audit logging on the charging station and export events to an off-device log store to preserve evidence in case of compromise.

bash

# Configuration example
# Restrict inbound access to the charging station web server
# Replace <mgmt_subnet> and <station_ip> with environment values
iptables -A INPUT -p tcp -s <mgmt_subnet> -d <station_ip> --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -d <station_ip> --dport 443 -j DROP