This vulnerability is an improper restriction of XML External Entity Reference (CWE-611). When a local user uploads a specially crafted TGML graphics file to the EcoStruxure Building Operation (EBO) server from a workstation, the server processes external XML entities without adequate restriction. This can lead to unauthorized disclosure of local server files, unintended interactions within the EBO system, or even a denial‑of‑service condition. The CVSS score of 7 indicates a high impact potential and moderate difficulty for exploitation based on the information provided.

Affected systems are Schneider Electric’s EcoStruxure Building Operation Webstation and Workstation. No specific version information is supplied, so all currently deployed versions of these products that handle TGML uploads are potentially exposed.

The CVSS score of 7 reflects a significant impact if successfully exploited. The EPSS score of less than 1% suggests that, as of now, the likelihood of exploitation is low. Because the attack requires a local user to upload a malicious TGML file, the attack vector is limited to users with access to the workstation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, which further indicates a lower current threat presence.