Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Vendor advisorySeverity 6.1 medium

Multiple Altivar Process Drives and Communication Modules

SEVD-2025-252-01 · Schneider Electric · September 9, 2025

Summary

Schneider Electric is aware of a vulnerability in its [ATVdPAC module](http://www.se.com/ww/en/product/VW3A3530D/atv-dpac-module/) / [ATV6000 Medium Voltage Altivar Process Drives](http://www.se.com/ww/en/product-range/65607-altivar-process-atv6000) / [ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives](http://www.se.com/ww/en/product-range/62317-altivar-process-atv600) / [ATV930/950/955/960/980/9A0/9B0/9L0 Altivar Process Drives](http://www.se.com/ww/en/product-range/63124-altivar-process-atv900) / [ATV340E Altivar Machine Drives](http://www.se.com/ww/en/product-range/63441-altivar-machine-atv340#products) /[ATS490 Altivar Soft Starter](http://www.se.com/ww/en/product-range/213421154-altivar-soft-starter-ats490) / [Altivar Process Communication Modules](http://www.se.com/ww/en/product-range/62317-altivar-process-atv600/117623851529-modular-drives-apm) product(s). Failure to apply remediation mitigations provided below may risk Cross-Site Scripting, which could result in partial loss of confidentiality and integrity of the workstation running a Web browser.

From Schneider Electric (vendor's own words, quoted), quoted as published. Check the source before acting.

What to do

Version 25.0 of VW3A3530D: ATVdPAC module includes a fix for this vulnerability and is available upon request from Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp). The version 4.5 of ATV6xx drives includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/62317-altivar-process-atv600/#software-and-firmware The version 4.5 of ATV9xx drives includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/63124-altivar-process-atv900/#software-and-firmware The version 4.5 of ATV340 drives includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/63441-altivar-machine-atv340/#software-and-firmware

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2025-77466.1 mediumNo0.4%Improper Neutralization of Input During Web Page Generation (CWE-79)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
Schneider ElectricATVdPAC modulevers:intdot/<25.025.0
Schneider ElectricAltivar Process Drives ATV630vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV650vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV660vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV680vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV6A0vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV6B0vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV6L0vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV930vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV950vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV955vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV960vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV980vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV9A0vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV9B0vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV9L0vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV991vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV992vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV993vers:intdot/<4.54.5
Schneider ElectricAltivar Process Drives ATV6000 Medium Voltagevers:intdot/<2.22.2
Schneider ElectricILC992 InterLink Convertervers:intdot/<2.32.3
Schneider ElectricAltivar Machine Drives ATV340Evers:intdot/<4.5—
Schneider ElectricAltivar Machine Drives ATV340—4.5
Schneider ElectricAltivar Soft Starter ATS490vers:generic/<1.2ie051.2ie05
Schneider ElectricAltivar Process Communication Modulesvers:all/*—

Why it's on these mode pages

  • Pipeline: Vendor table: Schneider Electric (matched by rule)

Change history

  1. September 9, 2025: Original Release
  2. September 16, 2025: Fixed the typo on the product name Altivar Process Communication Modules.
  3. October 14, 2025: Remediations are now available for ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives, ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drives and ATV340E Altivar Machine Drives.
  4. December 9, 2025: Remediations are now available for ATS490 Altivar Soft Starter.
  5. May 12, 2026: Remediations are now available for ATV6000 Altivar Process Drives.
  6. October 13, 2026: Remediations are now available for ILC992 InterLink Converter
  7. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com