CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials w…

Published 19 mo ago 2025-03-12 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.0

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.2%

percentile 6%

Public exploits

none known

CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 19 mo ago 2025-03-12

Exploit prediction (EPSS)

0.17% probability of exploitation in the next 30 days, higher than 6% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	4.0	`CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N`
CNA	3.1	6.0	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N`
CNA	4.0	4.0	`CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	6.0	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N`

Affected products

Schneider Electric EcoStruxure Panel Server

Classification

Weakness

CWE-532 Insertion of Sensitive Information into Log File

References

download.schneider-electric.com /files?p_Doc_Ref=SEVD-2025-070-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-

Sources

CVE List: CVE-2025-2002
NVD: CVE-2025-2002

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary