Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability within the VxWorks Operating System from Wind
River. Many vendors, including Schneider Electric, embed VxWorks in their offers.
If successfully exploited, these vulnerabilities could result in loss of confidentiality, integrity and
denial of service in the BMENOC0321 https://www.se.com/ww/en/product/BMENOC0321/m580-noc-control/ , BMECRA https://www.se.com/ww/en/product/BMECRA31210 and 140CRA products which are
communication modules for Modicon M580 and Quantum controllers.
Failure to apply the mitigations and remediations provided below may risk stack overflow attack,
which could result in loss of confidentiality, integrity and denial of service of the device.

Overview

Vulnerabilities disclosed by Wind River VxWorks product impact Schneider Electric Communication modules. Additional information about the vulnerability can be found at: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2021-29999

Vulnerability Details

Summary: Wind River VxWorks DHCP Server Vulnerability - SEVD-2025-014-03 PDF Version

Summary: Wind River VxWorks DHCP Server Vulnerability - SEVD-2025-014-03 CSAF Version

Summary: Original Release

Summary:
A remediation is now available for
BMECRA31210, BMXCRA31200, and
BMXCRA31210

Summary: Remediations are available for 140CRA31200 (Quantum RIO Drop) and 140CRA31908 (M580 Quantum S908 RIO Drop Adapter)

Schneider Electric

Schneider Electric Modicon M580 communication modules BMENOC0321 versions prior to SV1.10

Schneider Electric Modicon M580 communication modules BMENOC0321 Version SV1.10

Schneider Electric Modicon M580 communication modules BMECRA31210 versions prior to SV02.80

Schneider Electric Modicon M580 communication modules BMECRA31210 Version SV02.80

Schneider Electric Modicon M580/Quantum communication modules BMXCRA31200 versions prior to SV02.80

Schneider Electric Modicon M580/Quantum communication modules BMXCRA31200 Version SV02.80

Schneider Electric Modicon M580/Quantum communication modules BMXCRA31210 versions prior to SV02.80

Schneider Electric Modicon M580/Quantum communication modules BMXCRA31210 Version SV02.80

Modicon Quantum communication modules

Schneider Electric Modicon Quantum communication modules 140CRA31200 versions prior to 02.80

Schneider Electric Modicon Quantum communication module 140CRA31908 versions prior to 02.80

Schneider Electric Modicon Quantum communication modules 140CRA31200 version 02.80

Schneider Electric Modicon Quantum communication module 140CRA31908 version 02.80

An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.

CVE Description

Version SV1.10 of BMENOC0321 includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/product/BMENOC0321/m580-
noc-control/

Version SV02.80 of BMECRA31210, BMXCRA31200,
BMXCRA31210 includes a fix for these vulnerabilities and
is available for download here:
https://www.se.com/ww/en/product-country-selector/?pageType=product&sourceId=BMXCRA31210

Version V02.80 of 140CRA31200 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product/140CRA31200/quantum-rio-drop-e-ip-1ch

Version V02.80 of 140CRA31908 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product/140CRA31908/m580-quantum-s908-rio-drop-adapter

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Implement a firewall to allow only authorized traffic
on 67/UDP and 68/UDP ports

CVE-2021-29999


Web Designer for Modicon Communication Modules

Summary: Original Release

Summary: Web Designer for FactoryCast modules - SEVD-2025-014-04 PDF Version

Summary: Web Designer for FactoryCast modules - SEVD-2025-014-04 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Web Designer configuration tool for the following
FactoryCast modules:
• BMXNOR0200H
• BMXNOE0110(H)
• BMENOC0311(C)
• BMENOC0321(C)
The Web Designer product is a software application used to create Web-based operator panels and configure
operating parameters for Web human machine interface (Web HMI) devices.
Failure to apply the Mitigations provided below may risk XML external entity attack, which could result in
information disclosure, workstation integrity and potential remote code execution on the compromised
computer.

Overview

Schneider Electric

Web Designer

Schneider Electric Web Designer for BMXNOR0200H All Versions

Schneider Electric Web Designer for BMXNOE0110(H) All Versions

Schneider Electric Web Designer for BMENOC0311(C) All Versions

Schneider Electric Web Designer for BMENOC0321(C) All Versions

CVE-2024-12476

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could
cause information disclosure, impacts workstation integrity and potential remote code execution on the
compromised computer, when specific crafted XML file is imported in the Web Designer configuration tool.

CVE Description

Customers should immediately apply the following
mitigations to reduce the risk of exploit.
Web Designer tool project file is based on XML language with specific
parameters. To ensure the integrity of this file please follow the
recommendations below:
• Encrypt project file (XML configuration file) when stored and restrict
the access to only trusted users.
• When exchanging files over the network, use secure communication
protocols.
• Only open project files received from a trusted source.
• Compute a hash of the project files and regularly check the
consistency of this hash to verify the integrity before usage.
To ensure you are informed of all updates, including details on affected
products and remediation plans, subscribe to Schneider Electric’s
security notification service here:
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Web Server on Modicon M340 and BMXNOE0100/0110,
BMXNOR0200H communication modules products.
The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network
communication modules used with Modicon M340. BMXNOR0200H is a communication module that enables
M580 and M340 platforms to use RTU protocol exchange with RTU stations.
Failure to apply the remediation/mitigations provided below may risk information disclosure on web pages,
modification of web pages and denial of serviceClick or tap here to enter text., which could result in the
unavailability of the controllers or modules.
August Update: Remediations are available for BMXNOE0100 (Modbus/TCP Ethernet Modicon M340 module)
and BMXNOE0110 (Modbus/TCP Ethernet Modicon M340 FactoryCast module)

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Summary: Web Server on Modicon M340 and BMXNOE0100/0110, BMXNOR0200H Communication Modules - SEVD-2025-014-05 PDF Version

Summary: Web Server on Modicon M340 and BMXNOE0100/0110, BMXNOR0200H Communication Modules - SEVD-2025-014-05 CSAF Version

Web Server on Modicon M340, Modbus/TCP Ethernet Modicon M340 module, Modbus/TCP Ethernet Modicon M340 FactoryCast module and Ethernet / Serial RTU communication modules

Summary: Original Release

Summary: Remediation is available for Modicon M340

Schneider Electric

Modbus/TCP Ethernet Modicon M340 module

Modbus/TCP Ethernet Modicon M340 module Versions prior to SV3.60

Modbus/TCP Ethernet Modicon M340 module Version SV3.60

Modbus/TCP Ethernet Modicon M340 FactoryCast module Versions prior to SV6.80

Modbus/TCP Ethernet Modicon M340 FactoryCast module Version SV6.80

Ethernet / Serial RTU module

Ethernet / Serial RTU module Versions prior to SV1.70IR26

Ethernet / Serial RTU module Version SV1.70IR26

Modicon M340 processors

Modicon M340 Firmware Versions prior to SV3.70 installed on Modicon M340 processors (part numbers BMXP34*)

Modicon M340 Firmware Version SV3.70 installed on Modicon M340 processors (part numbers BMXP34*)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could
cause information disclosure of restricted web page, modification of web page and denial of
service when specific web pages are modified and restricted functions are invoked.

CVE Description

CVSS v4.0 Base Score 8.8 | High | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0  Score

Version SV1.70IR26 of BMXNOR0200H includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product/BMXNOR0200H/ethernet-serial-rtu-module-2-x-rj45/

Version SV3.70 of Modicon M340 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware

Version SV3.60 of BMXNOE0100 includes a fix for this vulnerability and is available for
download here:
https://www.se.com/ww/en/product/BMXNOE0100/network-module-modicon-m340-
modbus-tcp-1-x-rj45-flash-memory-card/

Version SV6.80 of BMXNOE0110 includes a fix for this vulnerability and is available for
download here:
https://www.se.com/ww/en/product/BMXNOE0110/ethernet-tcp-ip-network-modulemodicon-m340-automation-platform-flash-memory-card-internal-ram-16-mb-1-x-rj45-
10-100/

CVE-2024-12142


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its RemoteConnect and SCADAPack™ x70 Utilities software
product.
The RemoteConnect and SCADAPack™ x70 Utilities https://www.se.com/ww/en/product-category/6000-telemetry-and-remote-scada-systems/  product is a configuration software providing a user
interface that allows users to configure and manage communications and operations for SCADAPack™ x70
devices.
Failure to apply the Mitigations provided below may risk deserialization of untrusted data, which could result in
loss of confidentiality, integrity and potential remote code execution on the compromised workstation.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We
strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and
Development environment or on an offline infrastructure. Contact Schneider Electric’s Technical Support at
supportRO@se.com if you need assistance.

Summary: RemoteConnect and SCADAPack™ x70 Utilities - SEVD-2025-014-06 PDF Version

Summary: RemoteConnect and SCADAPack™ x70 Utilities - SEVD-2025-014-06 CSAF Version

Summary: Original Release

Summary: The affected versions for the RemoteConnect and Security Administrator has been identified, and a remediation is now available for the RemoteConnect configuration software included in the RemoteConnect and SCADAPack™ x70 Utilities product bundle.

Schneider Electric

RemoteConnect and SCADAPack™ x70 Utilities - RemoteConnect versions prior to R3.4.2

RemoteConnect and SCADAPack™ x70 Utilities - Security Administrator All Versions

RemoteConnect configuration software

RemoteConnect configuration software version R3.4.2

CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity
and potential remote code execution on workstation when a non-admin authenticated user opens a malicious
project file.

CVE Description

Version R3.4.2 RemoteConnect configuration software includes a fix for this vulnerability and is available for download here:https://www.se.com/ww/en/download/document/RemoteConnect/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Schneider Electric is establishing a remediation plan for all future versions of Security Administrator configuration software that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:• Only open project files received from a trusted source. • Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage.• Encrypt project file when stored and restrict the access to only trusted users. • When exchanging files over the network, use secure communication protocols. • Follow the SCADAPack™ Security Guidelines

CVE-2024-12703


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

 Customers should use appropriate patching methodologies when applying these patches to their systems. We
strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and
Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if
you need assistance removing a patch.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

About Schneider Electric

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Technical Support at supportRO@se.com if you need assistance.

Schneider Electric is aware of a vulnerability disclosed on Revenera FlexNet Publisher component.
Many vendors, including Schneider Electric, embed Revenera FlexNet Publisher in their offers.
Failure to apply the remediation/mitigations provided below may risk a local privilege escalation, which could
lead to the execution of a malicious DLL with elevated privilege.

Overview

Summary: FlexNet Publisher Vulnerability - SEVD-2025-014-07 PDF Version

Summary: FlexNet Publisher Vulnerability - SEVD-2025-014-07 CSAF Version

Summary: Revenera Advisory

FlexNet Publisher Vulnerability

Summary: Original Release

Summary: A remediation is available for the EcoStruxure™ Process Expert offer. The EcoStruxure™ Process Expert for AVEVA System Platform offer is added to the “Affected Product and Versions” section

Summary: Pro-face BLUE is added to the “Affected Product and Versions” section. Remediations are now available for EcoStruxure™Control Expert, EcoStruxure™ Operator Terminal Expert and Pro-face BLUE offers. Updated the link to the fix of EcoStruxure™ Control Expert Asset Link offer

Summary: A remediation is now available for Zelio Soft 2 and EcoStruxure™ OPC UA Server Expert offers

Summary: CVE, CWE, & CVSS Score information was added.

Summary: A remediation is now available for EcoStruxure™ Machine Expert and EcoStruxure™ Machine Expert Twin

Schneider Electric

EcoStruxure™ Control Expert

EcoStruxure™ Control Expert Versions prior to V16.2

EcoStruxure™ Process Expert

<2023 (v4.8.0.5715)

EcoStruxure™ Process Expert Versions prior to 2023 (v4.8.0.5715)

EcoStruxure™ OPC UA Server Expert

EcoStruxure™ OPC UA Server Expert Versions prior to SV2.01SP3

EcoStruxure™ OPC UA Server Expert Version SV2.01SP3

EcoStruxure™ Control Expert Asset Link

<4.0 SP1

EcoStruxure™ Control Expert Asset Link Versions prior to V4.0 SP1

EcoStruxure™ Machine SCADA Expert Asset Link All versions

EcoStruxure™ Architecture Builder

EcoStruxure™ Architecture Builder Versions prior to V7.0.18

EcoStruxure™ Operator Terminal Expert

EcoStruxure™ Operator Terminal Expert Versions prior to V4.0

Vijeo Designer

<6.3SP1 HF1

Vijeo Designer Version prior to V6.3SP1 HF1

EcoStruxure™ Machine Expert

EcoStruxure™ Machine Expert versions prior to v2.5.0.1

EcoStruxure™ Machine Expert version v2.5.0.1

EcoStruxure™ Machine Expert Twin

EcoStruxure™ Machine Expert Twin versions prior to v2.3

EcoStruxure™ Machine Expert Twin version v2.3

EcoStruxure™ Control Expert

EcoStruxure™ Control Expert Version V16.2

EcoStruxure™ Architecture Builder

EcoStruxure™ Architecture Builder Version V7.0.18

EcoStruxure™ Control Expert Asset Link

EcoStruxure™ Control Expert Asset Link Version V4.0SP1

EcoStruxure™ Process Expert for AVEVA System Platform All versions

EcoStruxure™ Process Expert 2023

2023 (v4.8.0.5715)

EcoStruxure™ Process Expert Version 2023 (v4.8.0.5715)

EcoStruxure™ Operator Terminal Expert

EcoStruxure™ Operator Terminal Expert Version V4.0

EcoStruxure™ Machine Expert Safety

EcoStruxure™ Machine Expert Safety All versions

Vulnerability disclosed by Revenera group in FlexNet Publisher impact Schneider Electric software.
Additional information about the vulnerability CVE-2024-2658 can be found in the Revenera Advisory at:
https://community.revenera.com/s/article/cve-2024-2658-flexnet-publisher-potential-local-privilege-escalation-issue

Vulnerability Details

CVSS v4.0 Base Score 8.5 | High | [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0  Score

Version 16.2 of EcoStruxure™ Control Expert includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/
Reboot the computer after installation is completed.

Version V7.0.18 of EcoStruxure™ Architecture Builder includes a fix for this vulnerability
and is available for download here:
https://www.se.com/ww/en/product-range/195445393-ecostruxure-architecture-builder/ -
software-and-firmware

Version V4.0SP1 of EcoStruxure™ Control Expert Asset Link includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/ECALV40SP1/

Version V6.3SP1 HF1 of Vijeo Designer includes a fix for this vulnerability. Please contact
your Schneider Electric Customer Support https://www.se.com/ww/en/work/support/country-selector/contact-us.jsp  to get Vijeo Designer version V6.3SP1 HF1
software.

Schneider Electric is establishing a remediation plan for all
future versions of the following that will include a fix for this
vulnerability:
• EcoStruxure™ Process Expert
• EcoStruxure™ OPC UA Server Expert
• EcoStruxure™ Machine SCADA Expert - Asset
Link
• EcoStruxure™ Operator Terminal Expert
• EcoStruxure™ Machine Expert including
EcoStruxure™ Machine Expert Safety
• EcoStruxure™ Machine Expert Twin
• Zelio Soft 2
We will update this document when the remediation is
available. Until then, customers should immediately apply
the following mitigations to reduce the risk of exploit:
• Limit authenticated user access to the workstation
and implement existing User Account Control
practices.
• Follow workstation, network and site-hardening
guidelines in the Recommended Cybersecurity
Best Practices guide available for download here https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true .

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Limit authenticated user access to the workstation and implement existing User Account Control
practices.
• Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best
Practices guide available for download here.

Version 2023 (v4.8.0.5715) of EcoStruxure™ Process Expert includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/product-country-selector/?pageType=productrange&
sourceId=65406
Uninstall previous version 2023 (v4.8.0.5115) before installing Version 2023
(v4.8.0.5715).
Version string can be found on engineering server console.

Version 2023 (v4.8.0.5715) of EcoStruxure™ Process Expert includes a fix for
this vulnerability and is available for download here:
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=65406

Version 4.0 of EcoStruxure™ Operator Terminal Expert includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/62621-ecostruxure-operator-terminal-expert/#software-and-firmware

Version 4.0 of Pro-face BLUE includes a fix for this vulnerability and is available
for download here:
https://www.proface.com/en/hmi_design_studio/blue/page/installer

Version 5.4.3 of Zelio Soft 2 includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/542-zelio-soft/#software-and-firmware

Version SV2.01SP3 of EcoStruxure™ OPC UA Server Expert includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/66388-ecostruxure-opc-ua-server-expert/#software-and-firmware

Version v2.5.0.1 of EcoStruxure™ Machine Expert includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/

Version v2.3 of EcoStruxure™ Machine Expert Twin includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/

CVE-2024-2658


Summary: Original Release

Summary: Power Logic HDPM6000 High-Density Metering System - SEVD-2025-014-08 PDF Version

Summary: Power Logic HDPM6000 High-Density Metering System - SEVD-2025-014-08 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Power Logic HDPM6000 High-Density Metering
System product.
The HDPM6000 products are high-density, multi-circuit busway and panelboard power meters for cost and
network management in large and critical power applications.
Failure to apply the remediation provided below may risk a low privileged user gaining higher level access,
which could allow for modification of system configuration parameters or an unauthenticated user causing data
corruption or denial of service to the devices web interface via a specially crafted Modbus protocol write
operation.

Overview

Schneider Electric

Power Logic

Schneider Electric Power Logic HDPM6000 Version 0.62.7 only

Schneider Electric Power Logic HDPM6000 Versions 0.62.7 and prior

Schneider Electric Power Logic HDPM6000 Versions 0.62.11 and newer

CVE-2024-10497

CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an
authorized attacker to modify values outside those defined by their privileges (Elevation of Privileges) when the
attacker sends modified HTTPS requests to the device.

CVE Description

Version v0.62.11 and newer of HDPM6000 includes a fix for
these vulnerabilities and is available for download here:
• https://www.se.com/ww/en/product-range/8297113-
powerlogic-hdpm6000/ - software-and-firmware
• A device restart will occur as part of the firmware update
process if conducted through the web user interface. If
the upgrade is performed using the HDPM6000 Manager
software, the device will need to be restarted manually to
apply the update.

If customers choose not to apply the remediation provided
above, they should immediately apply the following mitigations
to reduce the risk of exploit:
• Ensure that the device is not accessible via the HTTPS
protocol outside the local network segment by applying
appropriate firewalls configuration and controls, and that
access to the network segment is protected and
controlled.

CVE-2024-10498

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that
could allow an unauthorized attacker to modify configuration values outside of the normal range when the
attacker sends specific Modbus write packets to the device which could result in invalid data or loss of web
interface functionality.

CVE Description

If customers choose not to apply the remediation provided
above, they should immediately apply the following mitigations
to reduce the risk of exploit:
• Ensure that the device is not accessible via the Modbus
protocol outside the local network segment by applying
appropriate firewalls configuration and controls, and that access to the network segment is protected and
controlled.


EcoStruxure™ Power Build Rapsody

Summary: Original Release

Summary: A remediation is available for this vulnerability in V2.8.4 INT and corrected the Affected Products and Versions table with EcoStruxure™ Power Build–Rapsody INT version

Summary: EcoStruxure™ Power Build Rapsody - SEVD-2025-014-09 PDF Version

Summary: EcoStruxure™ Power Build Rapsody - SEVD-2025-014-09 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Build Rapsody software.
The EcoStruxure™ Power Build Rapsody is used to enter or import the single line diagram, to get the
extensive bill of material of your switchboard, including all devices, connection items, and mounting
components
Failure to apply the remediations and mitigations provided below may risk memory corruption, heap-based
buffer overflow, stack-based buffer overflow, which could result in local attackers being able to exploit these
issues to potentially execute arbitrary code.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Schneider Electric

EcoStruxure™ Power Build Rapsody

<=2.5.2 NL

Schneider Electric EcoStruxure™ Power Build Rapsody Versions v2.5.2 NL and prior

EcoStruxure™ Power Build Rapsody

<=2.7.1 FR

Schneider Electric EcoStruxure™ Power Build Rapsody Versions v2.7.1 FR and prior

EcoStruxure™ Power Build Rapsody

<=2.7.5 ES

Schneider Electric EcoStruxure™ Power Build Rapsody Versions v2.7.5 ES and prior

EcoStruxure™ Power Build Rapsody

<=2.6.4 INT

Schneider Electric EcoStruxure™ Power Build Rapsody Versions v2.6.4 INT and prior

EcoStruxure™ Power Build Rapsody

2.7.2 NL

Schneider Electric EcoStruxure™ Power Build Rapsody Version v2.7.2 NL

EcoStruxure™ Power Build Rapsody

2.7.52 ES

Schneider Electric EcoStruxure™ Power Build Rapsody Version v2.7.52 ES

EcoStruxure™ Power Build Rapsody

2.7.12 FR

Schneider Electric EcoStruxure™ Power Build Rapsody Version v2.7.12 FR

EcoStruxure™ Power Build Rapsody

2.8.4 INT

Schneider Electric EcoStruxure™ Power Build Rapsody Version v2.8.4 INT

CVE-2024-11139

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that
could allow local attackers to exploit these issues to potentially execute arbitrary code when opening a
malicious project file.

CVE Description

Version NL v2.7.2 of EcoStruxure™ Power Build–Rapsody includes a fix for this
vulnerability and are available for download here:
https://www.se.com/nl/nl/product-range/2309-ecostruxure-power-buildrapsody/#software-and-firmware
Please reboot after installing the new version.

Version FR v2.7.12 of EcoStruxure™ Power Build–Rapsody includes a fix for
this vulnerability and are available for download here:
https://www.se.com/fr/fr/product-range/2309-ecostruxure-power-buildrapsody/#software-and-firmware
Please reboot after installing the new version.

Version ES v2.7.52 of EcoStruxure™ Power Build–Rapsody includes a fix for
this vulnerability and are available for download here:
https://www.se.com/es/es/product-range/2309-ecostruxure-power-buildrapsody/#software-and-firmware
Please reboot after installing the new version.

Version v2.8.4 INT of EcoStruxure™ Power Build–Rapsody includes a fix for this vulnerability and is available for download here:https://www.se.com/ww/en/product-range/2309-ecostruxure-power-build-rapsody/#overview
Please reboot the system after installing the new version.

If customers choose not to apply the remediation provided above, they should
 immediately apply the following mitigations to reduce the risk of exploit:
• Only open projects from trusted sources.
• Ensure use of Malware scans before opening any externally created
Project
• Encrypt project file when stored and restrict the access to only trusted
users.
• When exchanging files over the network, use secure communication
protocols.
• Compute a hash of the project files and regularly check the consistency of
this hash to verify the integrity before usage.
To ensure you are informed of all updates, including details on affected
products and remediation plans, subscribe to Schneider Electric’s security
notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp


ASCO 5310 / 5350 Remote Annunciator

Summary: Original Release

Summary: ASCO 5310 / 5350 Remote Annunciator - SEVD-2025-042-01 PDF Version

Summary: ASCO 5310 / 5350 Remote Annunciator - SEVD-2025-042-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

LEGAL DISCLAIMER

Schneider’s purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its ASCO 5310 Remote Annunciator and ASCO 5350
Remote Annunciator products.
The ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products are stand-alone,
industrial grade interface devices providing transfer switch status indication and transfer/retransfer control.
Failure to apply the mitigations provided below may risk a Denial of Service, loss of availability, or loss of
device integrity, which could result in the inability to use the Remote Annunciator to monitor transfer switch
status and/or perform transfer/retransfer operations. The base operation of the transfer switch itself is not
impacted.

Overview

Schneider Electric ASCO 5310 Single-Channel Remote Annunciator All Versions

Schneider Electric ASCO 5350 Eight Channel Remote Annunciator All Versions

CVE-2025-1058

CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device
inoperable when malicious firmware is downloaded.

CVE Description

Schneider Electric is establishing a remediation plan for all future versions of ASCO
5310 Single-Channel Remote Annunciator and ASCO 5350 Eight Channel Remote
Annunciator that may include a fix for these vulnerabilities. We will update this
document when the remediation is available. Until then, customers should
immediately apply the following mitigations to reduce the risk of exploit:

• Use remote annunciator devices only in a protected environment to minimize
network exposure and ensure that they are not accessible from public internet
or untrusted networks.

• Change default password to help prevent unauthorized access to device
settings and information.

• Setup network segmentation and implement a firewall to block all
unauthorized access to the annunciator port 80/HTTP.

• For more details on the ASCO 5310 refer to “Installation Manual | ASCO 5310
ATS Remote Annunciator” which can be found here:
https://www.se.com/ww/en/product-range/66129-asco-5310-singlechannelremote-annunciator/-documents

• For more details on the ASCO 5350 refer to “Installation Manual | ASCO 5350
ATS Remote Annunciator” which can be found here:
https://www.se.com/ww/en/product-range/66130-asco-5350-eight-channelremote-annunciator/-documents

To ensure you are informed of all updates, including details on affected products and
remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

CVE-2025-1059

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could
cause communications to stop when malicious packets are sent to the webserver of the device.

CVE Description

CVE-2025-1060

CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure
of data when network traffic is being sniffed by an attacker.

CVE Description

CVE-2025-1070

CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device
inoperable when a malicious file is downloaded.

CVE Description


Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its [Uni-Telway driver](https://www.se.com/us/en/product-range/573-unitelway/#overview) which is part of [EcoStruxure™ Control Expert](https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#overview), [EcoStruxure™ Process Expert](https://www.se.com/ww/en/product-range/65406-ecostruxure-process-expert), [EcoStruxure™ Process Expert for AVEVA System Platform](https://www.se.com/ww/en/product-range/55570689-ecostruxure-process-expert-for-aveva-system-platform/#overview) and [OPC Factory Server](https://www.se.com/ww/en/product-range/547-opc-factory-server/) products.

Failure to apply the mitigations provided below may risk denial of service of engineering workstation, which could result in interruption of engineering operation. January 2026 Update: Mitigation are now available for EcoStruxure™ Process Expert.

Overview

Summary: Improper Input Validation Vulnerability in Uni-Telway Driver - SEVD-2025-042-02 PDF Version

Summary: Improper Input Validation Vulnerability in Uni-Telway Driver - SEVD-2025-042-02 CSAF Version

Summary: Original Release

Summary: Mitigations section updated for EcoStruxure™ Control Expert and OPC Factory Server.

Summary: Mitigations are now available for EcoStruxure™ Process Expert. EcoStruxure™ Process Expert found to be not affected by this vulnerability and advisory title has been modified

Summary: Removed comment “EcoStruxure™ Process Expert found to be not affected by this vulnerability.

Schneider Electric

EcoStruxure™ Control Expert

EcoStruxure™ Control Expert Version 16.2

EcoStruxure™ Process Expert

EcoStruxure™ Process Expert Version 2025

Uni-Telway driver installed on EcoStruxure™ Control Expert All versions

Uni-Telway driver installed on EcoStruxure™ Process Expert All versions

Uni-Telway driver installed on EcoStruxure™ Process Expert for AVEVA System Platform All versions

Uni-Telway driver installed on OPC Factory Server All versions

Sangjun Park
Jongseoung Kim
Byunghyun Kang
Yunjin Park
Kwon Yul
Seungchan Kim

CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering
workstation when specific driver interface is invoked locally by an authenticated user with crafted input.

CVE Description

CVSS v4.0 Base Score 6.8 | Medium | [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

For customers requiring the use of Uni-Telway driver, Schneider Electric recommends using following mitigations to reduce the risk of exploit: • McAfee Application and Change Control software for application control. Refer to the Cybersecurity Application Note available https://www.se.com/ww/en/download/document/EIO0000004778/. • Follow workstation, network and site-hardening guidelines in the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document. For customers not requiring the use of Uni-Telway driver, Schneider Electric recommends uninstalling the driver. Version 16.2 of EcoStruxure™ Control Expert, version 2025 of EcoStruxure™ Process Expert and version 3.63SP3 of OPC Factory Server do not include Uni-Telway driver by default anymore. This vulnerability is only affecting customers who have installed Uni-Telway driver.

CVE-2024-10083


Summary: Original Release

Summary: EcoStruxure™ Process Expert, EcoStruxure™ Process Expert for AVEVA  - SEVD-2025-042-03 PDF Version

Summary: EcoStruxure™ Process Expert, EcoStruxure™ Process Expert for AVEVA  - SEVD-2025-042-03 CSAF Version

Public

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

 Customers should use appropriate patching methodologies when applying these patches to their systems. We
strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and
Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if
you need assistance removing a patch.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Process Expert, EcoStruxure™ Process
Expert for AVEVA System Platform products.
The EcoStruxure™ Process Expert, EcoStruxure™ Process Expert for AVEVA System Platform products are
engineering tools that facilitates and automates the design, maintenance, commissioning, and operation of
Control projects for Modicon controllers and the associated Supervision projects for SCADA software
regrouped in a system..
Failure to apply the Fix/Mitigations provided below may risk a local privilege escalation, which could result in
loss of confidentiality, integrity and availability of the engineering workstation.

Overview

Schneider Electric

EcoStruxure™ Process Expert

2020 R2

Schneider Electric EcoStruxure™ Process Expert version 2020 R2

Schneider Electric EcoStruxure™ Process Expert version 2021

EcoStruxure™ Process Expert 2023

Schneider Electric EcoStruxure™ Process Expert 2023 versions prior to v4.8.0.5715

2020 R2

Schneider Electric EcoStruxure™ Process Expert for AVEVA System version 2020 R2

Schneider Electric EcoStruxure™ Process Expert for AVEVA System version 2021

Schneider Electric EcoStruxure™ Process Expert for AVEVA System version 2023

EcoStruxure™ Process Expert 2023

Schneider Electric EcoStruxure™ Process Expert 2023 v4.8.0.5715

CVE-2025-0327

CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit
trail data and the other acting as server managing client request) that could cause a loss of Confidentiality,
Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the
executable path of the windows services. To be exploited, services need to be restarted.

CVE Description

Version v4.8.0.5715 of EcoStruxure™ Process Expert 2023 Software
Package includes a fix for this vulnerability and is available for download
here:
https://www.se.com/au/en/product-range/65406-ecostruxure-processexpert/#software-and-firmware
Uninstall Previous Version 2023 (v4.8.0.5115) before installing Version
2023 (v4.8.0.5715).
Version string could be found on engineering server console.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

• Allow execute permission for service control Windows utility only to
admin user.
• McAfee Application and Change Control software for application control
to allow execution of whitelisted applications only. Refer to the
Cybersecurity Application Note available
https://www.se.com/ww/en/download/document/EIO0000004778/

Schneider Electric is establishing a remediation plan for all future versions of
EcoStruxure™ Process Expert for AVEVA System Platform that will include a fix
for this vulnerability. We will update this document when the remediation is
available. Until then, customers should immediately apply the following
mitigations to reduce the risk of exploit:

• Allow only admin user to configure windows service by restricting
execute permission of sc.exe windows utility.

• McAfee Application and Change Control software for application control
to allow execution of whitelisted applications only. Refer to the
Cybersecurity Application Note available
https://www.se.com/ww/en/download/document/EIO0000004778/


Enerlin'X IFE and eIFE

Summary: Original Release

Summary: Enerlin'X IFE and eIFE - SEVD-2025-042-04 PDF Version

Summary: Enerlin'X IFE and eIFE - SEVD-2025-042-04 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of vulnerabilities in its Enerlin'X IFE and Enerlin'X eIFE products.

The Enerlin'X IFE and eIFE products https://www.se.com/ww/en/product-range/62413-enerlinx-ife-eife-ifm/#products are used to enable Masterpact, PowerPact, and Compact circuit breakers
to be connected to an Ethernet network.

Failure to apply the provided below may risk Denial of Service, which could result in an attack which leads to
unavailability of the IEC61850 services of the IFE/eIFE products and needs a manual reboot.

Overview

Schneider Electric

Enerlin'X IFE interface

Schneider Electric Enerlin'X IFE interface (LV434001) All Versions

Enerlin'X eIFE

Schneider Electric Enerlin'X eIFE (LV851001) All Versions

Enerlin'X IFE interface

Schneider Electric Enerlin'X IFE interface Version 004.009.000 and prior

Enerlin'X eIFE

Schneider Electric Enerlin'X eIFE v004.009.000 and prior

Enerlin'X IFE interface

Schneider Electric Enerlin'X IFE interface Version 004.010.000

Enerlin'X eIFE

Schneider Electric Enerlin'X eIFE Version 004.010.000

CVE-2025-0816

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the
product when malicious IPV6 packets are sent to the device.

CVE Description

CVE-2025-0815

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the
product when malicious ICMPV6 packets are sent to the device.

CVE Description

CVE-2025-0814

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network
services running on the product when malicious IEC61850-MMS packets are sent to the device. The core
functionality of the breaker remains intact during the attack.

CVE Description

Version 004.010.000 of Enerlin'X IFE and eIFE includes a fix for this
vulnerability. Download the latest version of the EcoStruxure Power
Commission tool available here:
https://www.se.com/ww/en/product-range/62980-ecostruxure-powercommission/#overview
to install the latest firmware version of the Enerlin'X IFE and eIFE.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

 Customers should immediately apply the following mitigations to reduce the risk of
exploit:
* Use devices only in a protected environment to minimize network
exposure and ensure that they are not accessible from public internet or
untrusted networks.
* Setup network segmentation and implement a firewall to block all
unauthorized access to ports supported by the product and listed in the
user guide:
https://www.se.com/ww/en/download/document/DOCA0084EN/
Configure the Access Control List following the recommendations of the
Cybersecurity Guide:
https://www.se.com/ww/en/download/document/DOCA0122EN/ and the
user guide:
https://www.se.com/ww/en/download/document/DOCA0084EN/

To ensure you are informed of all updates, including details on affected products
and remediation plans, subscribe to Schneider Electric's security notification
service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp


EcoStruxure™ Panel Server

Summary: Original Release

Summary: EcoStruxure™ Panel Server - SEVD-2025-070-01 PDF Version

Summary: EcoStruxure™ Panel Server - SEVD-2025-070-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document https://www.se.com/us/en/download/document/7EN52-0390/.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Panel Server product, all models.

The EcoStruxure™ Panel Server https://www.se.com/us/en/product-range/40739468-ecostruxure-panel-server/#products is a modular gateway with enhanced cybersecurity that provides easy and
fast connections to multiple concurrent edge control or cloud applications.

Failure to apply the remediations provided below may risk disclosure of sensitive information, including the
disclosure of credentials.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center (https://www.se.com/us/en/work/support/) if you need assistance removing a patch.

Schneider Electric

EcoStruxure Panel Server

Schneider Electric EcoStruxure™ Panel Server Version v2.0 and prior

EcoStruxure Power Commission

Schneider Electric EcoStruxure™ Panel Server Version 2.1 and later installed with Schneider Electric EcoStruxure™ Power Commission Software version 2.33.0 and later

CVE-2025-2002

CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure
of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an
administrative user and the debug files are exported from the device.

CVE Description

Version V2.1 or later of EcoStruxure™ Panel Server includes a fix for this
vulnerability and is available for download here:

https://www.se.com/ww/en/product-range/40739468-ecostruxure-panel-server/?parent-subcategory-id=4160#software-and-firmware

Customers should download EcoStruxure™ Power Commission Software
version 2.33.0 or later, and version V2.1 or later of EcoStruxure™ Panel
Server firmware to complete the upgrade process.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
* Ensuring that debug mode is off will prevent the credentials from being improperly exposed.


EPAS-UI & EcoSUI

Summary: Original Release

Summary: EPAS-UI & EcoSUI - SEVD-2025-070-02 PDF Version

Summary: EPAS-UI & EcoSUI - SEVD-2025-070-02 CSAF Version

Public

General Security Recommendations

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Automation System User Interface
(EPAS-UI) product.

The EcoStruxure Power Automation System User Interface (EPAS-UI) https://www.se.com/ng/en/product-range/61456-ecostruxure-power-automation-system-user-interface/#overview product is an HMI SCADA designed for
electrical networks and substations operations.

Failure to apply the fix provided below may risk an Authentication Bypass attack, which could result in an
attacker taking partial to full control of EPAS-UI.

Overview

Schneider Electric

>=2.1 | <=2.9

Schneider Electric EcoStruxure™ Power Automation System User Interface (EPAS-UI) Secured Versions from version 2.1 up to and including version 2.9

Schneider Electric EcoStruxure™ Power Automation System User Interface (EPAS-UI) Version 2.10

CVE-2025-0813

CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an
unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to
reboot the workstation and interrupt the normal boot process.

CVE Description

Version 2.10 of EcoStruxure™ Power Automation System User Interface
(EPAS-UI) includes a fix for this vulnerability and is available by contacting
Schneider Electric’s Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:

Please strictly follow all the instructions below:

Step 1: Login with Admin privileges

Step 2: Go to the folder C:\MCIS\Bin

Step 3: Rename the file ‘MCIS.chm’ to ‘MCIS.old’

Note: to see file extensions, activate the visualization of file name extensions in Windows Explorer ‘View’
options.

Step 4: Restart the machine


Summary: Original Release

Summary: WebHMI Component For EcoStruxure™ Power Automation System User Interface and EcoStruxure™ Microgrid Operation Large - SEVD-2025-070-03 PDF Version

Summary: WebHMI Component For EcoStruxure™ Power Automation System User Interface and EcoStruxure™ Microgrid Operation Large - SEVD-2025-070-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its WebHMI component used in EcoStruxure™ Power
Automation System User Interface product and EcoStruxure™ Microgrid Operation Large (EMO-L) solution.

EcoStruxure™ Power Automation System User Interface https://www.se.com/ng/en/product-range/61456-ecostruxure-power-automation-system-user-interface/#overview (formerly known as EcoSUI) is a local SCADA/HMI,
based on IEC 61850, that helps operators supervise, monitor, and control large and open electrical networks,
with embedded cybersecurity. Formerly EcoStruxure Substation Operation User Interface.

EcoStruxure™ Microgrid Operation Large (EMO-L) https://www.se.com/ca/en/product-range/65897-ecostruxure-microgrid-operation/#overview  is a power management system dedicated to large and
critical Microgrid application. EMO-L is based on EcoStruxure™ Power Automation System solution (EPAS)
with dedicated HMI which allows the monitoring and control of the distributed energy resources systems within
the Microgrid. One HMI option for EMO-L is EcoSUI (WebHMI).

Failure to apply the remediations provided below may risk unauthorized access to the underlying software
application running WebHMI.

Overview

EMO-L is based on EcoStruxure™ Power Automation System solution (EPAS). EMO-L customers using
the versions above are affected.

Affected Products and Versions

Schneider Electric

EPAS User Interface

EcoStruxure Microgrid Operation Large (EMO-L)

Schneider Electric WebHMI version 4.1.0.0 and prior installed with Schneider Electric EPAS User Interface version 2.6.30.19 and prior default component of Schneider Electric EcoStruxure™ Microgrid Operation Large (EMO-L)

Schneider Electric WebHMI_Fix_users_for_Standard V1 applied on WebHMI version 4.1.0.0 and prior

CVE-2025-1960

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an
attacker to execute unauthorized commands when a system’s default password credentials have not been
changed on first use. The default username is not displayed correctly in the WebHMI interface.

CVE Description

Hotfix WebHMI_Fix_users_for_Standard.V1 of WebHMI includes a fix for this vulnerability and can be obtained from Schneider Electric Customer Care Center.

In addition to the remediation provided above, they should immediately apply the following mitigations to
reduce the risk of exploit:
* Once the hotfix, WebHMI_Fix_users_for_Standard.V1, has been applied, we recommend ensuring that all
hardening guidelines provided with the product are implemented to maintain best practices for defense-indepth. Specifically, the WebHMI should not be exposed to the internet. Contact Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp  for
assistance is required.


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of vulnerabilities in its ConneXium Network Manager software.
The ConneXium Network Manager software provides a solution for configuring and monitoring the
administrable Schneider Electric devices, including switches, routers, firewalls, ConneXium Wi-Fi devices, and
products from various manufacturers.
Failure to apply the mitigations below may risk sensitive data disclosure, leading privilege escalation through
man-in-the-middle attacks on ConneXion Network Manager, denial of service, and remote code execution on
engineering workstations.

May 2025 Update: The CVSS v3.1 vector string was updated.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 3.1 (CVSS v3.1 https://www.first.org/cvss/calculator/3.1). CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Threat and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Summary: ConneXium Network Manager Software - SEVD-2025-098-01 PDF Version

Summary: ConneXium Network Manager Software - SEVD-2025-098-01 CSAF Version

ConneXium Network Manager Software

Summary: Original Release

Schneider Electric

ConneXium Network Manager

Schneider Electric ConneXium Network Manager v2.0.01

Schneider Electric ConneXium Network Manager All versions

CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak
information and potential privilege escalation following man in the middle attack.

CVE Description

Please note that the ConneXium Network Manager product has reached the end of its life and is no longer supported.
 Customers should immediately apply the following mitigations to reduce the
risk of exploit:
• Disable the webserver (disabled by default)
• Follow workstation, network and site-hardening guidelines in the
Recommended Cybersecurity Best Practices available for download
here: https://www.se.com/ww/en/download/document/7EN52-0390/

CVE-2025-2222

CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and
Availability of engineering workstation when a malicious project file is loaded by a user from the local system.

CVE Description

Please note that the ConneXium Network Manager product has reached the end of its life and is no longer supported.
Customers should immediately apply the following mitigations to reduce the
risk of exploit:
• Only open project files received from a trusted source.
• Compute a hash of the project files and regularly check the
consistency of this hash to verify the integrity before usage.
• Encrypt project file when stored and restrict the access to only trusted
users.
• When exchanging files over the network, use secure communication
protocols.
• Follow workstation, network and site-hardening guidelines in the
Recommended Cybersecurity Best Practices available for download
here: https://www.se.com/ww/en/download/document/7EN52-0390/

CVE-2025-2223


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Trio™ Q Licensed Data Radio product.
The Trio Q Licensed Data Radios product is an advanced, high-speed licensed digital data radios, providing both
Ethernet and serial communications for complex and demanding applications in Point-to-Point Multipoint (Multiple
Address Radio) Telemetry and remote SCADA Systems.
Failure to apply the remediations or mitigations provided below may risk disclosure of information that could result
in unauthorized access, loss of confidentiality, integrity, and availability of the product.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 3.1 (CVSS v3.1-https://www.first.org/cvss/calculator/3.1). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Summary: Trio™ Q Licensed Data Radios - SEVD-2025-098-02 PDF Version

Summary: Trio™ Q Licensed Data Radios - SEVD-2025-098-02 CSAF Version

Trio™ Q Licensed Data Radios

Summary: Original Release

Schneider Electric

Trio™ Q Licensed Data Radio

Schneider Electric Trio™ Q Licensed Data Radio version prior to 2.7.2

Schneider Electric Trio™ Q Licensed Data Radio version 2.7.2

CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized
access of confidential data when a malicious user, having physical access and advanced information on the file
system, sets the radio in factory default mode.

CVE Description

Version v2.7.2 of the TRIO™ Q Data Radio firmware includes fixes for the identified
vulnerabilities and is available for download here:
https://www.se.com/ww/en/product-range/61419-trio-licensed-radios/#software-andfirmware
Instructions should be followed from Section 10 Part J – Firmware Updating and
Maintenance in the Trio Q Series Data Radio User Manual
This section provides information on how to download, install, and verify the new
firmware version.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Trio™ Data Radios should be installed in a secure location to prevent
physical access by unauthorized personnel and securely disposed
when decommissioned.
• Firmware loaded in Trio™ Data Radios should be confirmed using the
hash published with the release notes and following the instructions in
Section 10 Part J – Firmware Updating and Maintenance in the Trio Q
Series Data Radio User Manual
This section provides information on how to download, install, and
verify the new firmware version.

CVE-2025-2440

CWE-1188: Incorrect Initialization of Resource vulnerability exists that could lead to loss of confidentiality when a
malicious user, having physical access, sets the radio in factory default mode where the product does not
correctly initialize all data.

CVE Description

CVE-2025-2441

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to
unauthorized access which could result in the loss of confidentially, integrity and availability when a malicious
user, having physical access, sets the radio to the factory default mode.

CVE Description

CVE-2025-2442


Public

General Security Recommendations

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251 / M258 / LMC058 products.

 The Modicon Controllers M241/M251/M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic Controllers for performance-demanding applications.

 Failure to apply remediation/mitigations provided below may risk an unauthenticated read of arbitrary files which could result in loss of confidential data stored on the controller.

 July 2025 Update: A remediation is now available within EcoStruxure™ Machine Expert v2.3 used to update the Modicon Controlers firmware.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

Summary: Modicon Controllers M241/M251/M258/LMC058 - SEVD-2025-133-01 PDF Version

Summary: Modicon Controllers M241/M251/M258/LMC058 - SEVD-2025-133-01 CSAF Version

Summary: Original Release

Summary:
A remediation for M241/M251 is now available within
EcoStruxure™ Machine Expert v2.3

Summary: A remediation is now available for Modicon M258 / LMC058

Schneider Electric

Modicon Controllers M241

Modicon Controllers M241 Versions prior to 5.3.12.48

Modicon Controllers M251

Modicon Controllers M251 Versions prior to 5.3.12.48

Modicon Controllers M258

Modicon Controllers M258 Versions prior to 5.0.4.19

Modicon Controllers M258 Version 5.0.4.19

Modicon Controllers LMC058

Modicon Controllers LMC058 Versions prior to 5.0.4.19

Modicon Controllers LMC058 Version 5.0.4.19

EcoStruxure Automation Expert - Motion

Modicon Controllers M241 5.3.12.48 installed on EcoStruxure™ Automation Expert - Motion Version 24.1

Modicon Controllers M241 5.3.12.48 installed on Modicon Controllers M241

Modicon Controllers M251 5.3.12.48 installed on Modicon Controllers M251

Modicon Controllers M241 5.3.12.48 installed on EcoStruxure™ Machine Expert 2.3

Modicon Controllers M251 Version 5.3.12.48 installed on EcoStruxure™ Automation Expert - Motion Version 24.1

Modicon Controllers M251 Version 5.3.12.48 installed on EcoStruxure™ Machine Expert 2.3

Modicon Controllers M258 Firmware Version 5.0.4.19 installed on Modicon Controllers M258

Modicon Controllers LMC058 Firmware Version 5.0.4.19 installed on Modicon Controllers LMC058

CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could
cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to
access resources.

CVE Description

Versions 5.3.12.48 of Modicon Controllers M241 include a fix for this vulnerability and can be downloaded here: M241:https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware

* Use the Controller Assistant feature of EcoStruxure™ Automation Expert - Motion V24.1 or EcoStruxure™ Machine Expert V2.3 to update the M241/M251 firmware and perform a reboot.

* EcoStruxure™ Automation Expert - Motion V24.1 and EcoStruxure™ Machine Expert V2.3 are available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER

* Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.

Versions 5.3.12.48 of Modicon Controllers M251 include a fix for this vulnerability and can be downloaded here: M251:https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware

* Use the Controller Assistant feature of EcoStruxure™ Automation Expert - Motion V24.1 or EcoStruxure™ Machine Expert V2.3 to update the M241/M251 firmware and perform a reboot.

* EcoStruxure™ Automation Expert - Motion V24.1 and EcoStruxure™ Machine Expert V2.3 are available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER

* Additional information is available in the Quick Start Guide, chapter “EcoStruxure™ Automation Expert Platform Installation”.

Modicon M258/LMC058 Firmware version 5.0.4.19 includes a fix for this vulnerability and can be downloaded here: https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Use controllers and devices only in a protected environment to
minimize network exposure and ensure that they are not
accessible from public internet or untrusted networks.
• Ensure usage of user management and password features. User
rights are enabled by default and forced to create a strong
password at first use.
• Deactivate the Webserver after use when not needed.
• Use encrypted communication links when available.
• Setup network segmentation and implement a firewall to block all
unauthorized access to ports 80/HTTP and 443/HTTPS.
• Use VPN (Virtual Private Networks) tunnels if remote access is required.
• The “Cybersecurity Guidelines for EcoStruxure Machine Expert,
Modicon and PacDrive Controllers and Associated Equipment” provide product specific hardening guidelines.

To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp

CVE-2025-2875