CVE-2025-7746: Schneider Electric ATS490 Altivar Soft Starter

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.

Affected products

• Schneider Electric ATS490 Altivar Soft Starter: any version
• Schneider Electric ATV340E Altivar Machine Drives: any version
• Schneider Electric ATV6000 Medium Voltage Altivar Process Drives: any version
• Schneider Electric ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives: any version
• Schneider Electric ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drives: any version
• Schneider Electric ILC992 Interlink Converter: any version
• Schneider Electric VW3A3530D: Atvdpac Module: before v25.0 (fixed in v25.0)
• Schneider Electric VW3A3720 & VW3A3721 Altivar Process Communication Modules: any version

Published 2025-09-09. Last modified 2026-06-17.