Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in EcoStruxure™ Building Operation Workstation and
EcoStruxure™ Building Operation WebStation.
[EcoStruxure™ Building Operation (EBO)](https://www.se.com/ww/en/product-range/62111-ecostruxure-building-operation-software/#overview) is an open and scalable software platform providing insight, control
and management of multiple building systems and devices in one mobile-enabled convenient view. It delivers
valuable data for decision-making to improve energy management and increase efficiency for better building
performance and comfort, reduced carbon, and more sustainable building environments.
Failure to apply the remediations below may risk exposure of local files or denial of service, which could result
in data breaches, and operational disruptions.

Overview

Summary: Multiple Vulnerabilities on EcoStruxure™ Building Operation Workstation and EcoStruxure™ Building Operation Webstation - SEVD-2026-041-02 PDF Version

Summary: Multiple Vulnerabilities on EcoStruxure™ Building Operation Workstation and EcoStruxure™ Building Operation Webstation - SEVD-2026-041-02 CSAF Version

Summary: Original Release

Schneider Electric

EcoStruxure™ Building Operation Workstation All 7.0.x versions prior to 7.0.3.2000 (CP1)

7.0.3.2000 (CP1)

EcoStruxure™ Building Operation Workstation Version 7.0.3.2000 (CP1)

EcoStruxure™ Building Operation Workstation All 6.x versions prior to 6.0.4.14001 (CP10)

6.0.4.14001 (CP10)

EcoStruxure™ Building Operation Workstation Version 6.0.4.14001 (CP10)

EcoStruxure™ Building Operation Workstation All 7.0.x versions prior to 7.0.2

EcoStruxure™ Building Operation Workstation Version 7.0.2

EcoStruxure™ Building Operation Workstation All 6.0.x versions prior to 6.0.4.7000 (CP5)

6.0.4.7000 (CP5)

EcoStruxure™ Building Operation Workstation Version 6.0.4.7000 (CP5)

EcoStruxure™ Building Operation WebStation All 7.0.x versions prior to 7.0.3.2000 (CP1)

7.0.3.2000 (CP1)

EcoStruxure™ Building Operation WebStation Version 7.0.3.2000 (CP1)

EcoStruxure™ Building Operation WebStation All 6.x versions prior to 6.0.4.14001 (CP10)

6.0.4.14001 (CP10)

EcoStruxure™ Building Operation WebStation Version 6.0.4.14001 (CP10)

EcoStruxure™ Building Operation Webstation All 7.0.x versions prior to 7.0.2

EcoStruxure™ Building Operation Webstation Version 7.0.2

EcoStruxure™ Building Operation Webstation All 6.0.x versions prior to 6.0.4.7000 (CP5)

6.0.4.7000 (CP5)

EcoStruxure™ Building Operation Webstation Version 6.0.4.7000 (CP5)

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could
cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service
conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from
Workstation.

CVE Description

CVSS v4.0 Base Score 7.0 | High | [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

The following versions of EcoStruxure™ Building Operation Workstation and EcoStruxure™ Building Operation WebStation
include a fix for CVE-2026-1227:
• 7.0.3.2000 (CP1)

Step 1: Navigate to this link:
https://www.se.com/myschneider/documentsDownloadCenter/detail?id=EBO-Patch-v7-0

Step 2: Download 'EcoStruxure Building Operation Patch v7.0'
Step 3: Follow the installation instructions provided in the accompanying
readme file.
Additionally, ensure you are following the [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&productversion=7.1&locale=en-US).

The following versions of EcoStruxure™ Building Operation Workstation and EcoStruxure™ Building Operation WebStation
includes a fix for CVE-2026-1227:
• 6.0.4.14001 (CP10)

Step 1: Locate the appropriate version for your system here:
https://www.se.com/myschneider/documentsDownloadCenter/detail?id=EBO-Patch-v6-0
Step 2: Download ‘EcoStruxure Building Operation Patch v6.0‘
Step 3: Follow the installation instructions provided in the accompanying
readme file.
Additionally, ensure you are following the [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&productversion=7.1&locale=en-US).

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Implement strong access controls to limit system access to authorized personnel.
• Use multi factor authentication if using EBO version 7.0 or later
• Use firewalls to segregate networks and protect the building management system
• Regularly monitor system activity
• Ensure you are following [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&productversion=7.1&locale=en-US).

CVE-2026-1227

Improper Control of Generation of Code ('Code Injection')

CWE-94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted
or unintended code within the application when maliciously crafted design content is processed through a
TGML graphics file.

CVE Description

CVSS v4.0 Score

The following versions of EcoStruxure™ Building Operation Workstation and EcoStruxure™ Building Operation WebStation
include a fix for CVE-2026-1226:
• 7.0.2

Step 1: Navigate to this link:
https://www.se.com/myschneider/documentsDownloadCenter/detail?id=EBO-Patch-v7-0

Step 2: Download 'EcoStruxure Building Operation Patch v7.0'
Step 3: Follow the installation instructions provided in the accompanying
readme file.

Additionally, ensure you are following the [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&productversion=7.1&locale=en-US).

The following versions of EcoStruxure™ Building Operation Workstation and EcoStruxure™ Building Operation WebStation
includes a fix for CVE-2026-1226:
• 6.0.4.7000 (CP5)
Step 1: Locate the appropriate version for your system here:
https://www.se.com/myschneider/documentsDownloadCenter/detail?id=EBO-Patch-v6-0

Step 2: Download ‘EcoStruxure Building Operation Patch v6.0‘
Step 3: Follow the installation instructions provided in the accompanying
readme file.
Additionally, ensure you are following the [EBO hardening guidelines](https://ecostruxure-building-help.se.com/bms/Topics/show.castle?id=14923&productversion=7.1&locale=en-US).

CVE-2026-1226


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, and M262 products.
The Modicon Controllers M241 / M251 / M262 are Programmable Logic Controllers for performancedemanding applications.
Failure to apply the remediation provided below may risk Denial of Service attack which could result in loss of
availability of the controller

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp) if you need assistance removing a patch.

Summary: Improper Resource Shutdown or Release vulnerability in Multiple Products - SEVD-2026-069-01 PDF Version

Summary: Improper Resource Shutdown or Release vulnerability in Multiple Products - SEVD-2026-069-01 CSAF Version

Summary: Original Release

Summary: Updated the acknowledgement section.

Schneider Electric

Modicon M241

Modicon M241 versions prior to 5.4.13.12

Modicon M251

Modicon M251 versions prior to 5.4.13.12

Modicon M262

Modicon M262 versions prior to 5.4.10.12

Modicon M241 Firmware versions prior to 5.4.13.12 installed on Modicon Controller M241

Modicon M251 Firmware versions prior to 5.4.13.12 installed on Modicon Controller M251

Modicon M262 Firmware versions prior to 5.4.10.12 installed on Modicon Controller M262

Modicon M241 Firmware Version 5.4.13.12 installed on Modicon Controller M241

Modicon M251 Firmware Version 5.4.13.12 installed on Modicon Controller M251

Modicon M262 Firmware Version 5.4.10.12 installed on Modicon Controller M262

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of
Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy
active communication channels.

CVE Description

CVSS v4.0 Base Score 6.9 | Medium | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)

CVSS v4.0  Score

Modicon Controller M241 Firmware version 5.4.13.12 delivered with
EcoStruxure™ Machine Expert v2.5.0.1 includes a fix for this vulnerability and can
be installed through Schneider Electric Software Installer available here:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
On the engineering workstation install v2.5.0.1 of EcoStruxure™ Machine Expert.
For help refer to Schneider Electric Software Installer User Guide available here:
https://www.se.com/ww/en/download/document/EIO0000005500/
Update Modicon Controller M241 to the latest Firmware and perform reboot. For
instructions refer to Modicon M241 Logic Controller, Programming Guide:
https://www.se.com/ww/en/download/document/EIO0000003059/

Modicon Controller M251 Firmware version 5.4.13.12 delivered with
EcoStruxure™ Machine Expert v2.5.0.1 includes a fix for this vulnerability and can
be installed through Schneider Electric Software Installer available here:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
On the engineering workstation install v2.5.0.1 of EcoStruxure™ Machine Expert.
For help refer to Schneider Electric Software Installer User Guide available here:
https://www.se.com/ww/en/download/document/EIO0000005500/
Update Modicon Controller M251 to the latest Firmware and perform reboot. For
instructions refer to Modicon M251 Logic Controller, Programming Guide:
https://www.se.com/ww/en/download/document/EIO0000003089/

Modicon Controller M262 Firmware version 5.4.10.12 delivered with
EcoStruxure™ Machine Expert v2.5 includes a fix for this vulnerability and can be
installed through Schneider Electric Software Installer available here:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
On the engineering workstation install v2.5.0.1 of EcoStruxure™ Machine Expert.
For help refer to Schneider Electric Software Installer User Guide available here:
https://www.se.com/ww/en/download/document/EIO0000005500/
Update Modicon Controller M262 to the latest Firmware and perform reboot. For
instructions refer to Modicon M262 Logic/Motion Controller, Programming Guide:
https://www.se.com/ww/en/download/document/EIO0000003651/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Use controllers and devices only in a protected environment to
minimize network exposure and ensure that they are not
accessible from public internet or untrusted networks.
• Filter ports and IP through the embedded firewall.
• Use encrypted communication links.
• Use VPN (Virtual Private Networks) tunnels if remote access is
required.
• The “Cybersecurity Guidelines for EcoStruxure Machine Expert,
Modicon and PacDrive Controllers and Associated Equipment”
provide product specific hardening guidelines

CVE-2025-13901


Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, M258, and LMC058
products.
The [Modicon Controllers M241 / M251 / M258](https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/) and [Modicon LMC058](https://www.se.com/ww/en/product-range/7744-modicon-lmc058/) are Programmable Logic Controllers for
performance-demanding applications.
Failure to apply the remediation or mitigations provided below may risk a Cross-site Scripting or an open
redirect attack which could result in an account takeover scenario or the execution of code in the user browser.

Overview

Summary: Improper Neutralization in Multiple Products - SEVD-2026-069-02 PDF Version

Summary: Improper Neutralization in Multiple Products - SEVD-2026-069-02 CSAF Version

Improper Neutralization vulnerability in Multiple Products

Summary: Original Release

Summary: Updated the acknowledgement section.

Schneider Electric

Modicon Controllers LMC058 Firmware

Modicon Controller M241 Firmware Versions prior to 5.4.13.12 installed on Modicon Controllers M241

Modicon Controller M241 Firmware Version 5.4.13.12 installed on Modicon Controllers M241

Modicon Controller M251 Firmware Versions prior to 5.4.13.12 installed on Modicon Controllers M251

Modicon Controller M251 Firmware Version 5.4.13.12 installed on Modicon Controllers M251

Modicon Controllers M258 Firmware All versions installed on Modicon Controllers M258

Modicon Controllers LMC058 Firmware All versions installed on Modicon Controllers LMC058

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary
JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected
payload.

CVE Description

CVSS v4.0 Base Score 5.1 | Medium | [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N)

CVSS 4.0 Score

Modicon Controller M241 Firmware version 5.4.13.12 delivered with
EcoStruxure™ Machine Expert v2.5.0.1 includes a fix for this vulnerability and
can be installed through Schneider Electric Software Installer available here:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/

On the engineering workstation install v2.5.0.1 of EcoStruxure™ Machine
Expert. For help refer to Schneider Electric Software Installer User Guide
available here:
https://www.se.com/ww/en/download/document/EIO0000005500/

Update Modicon Controller M241 to the latest Firmware and perform reboot. For
instructions refer to Modicon M241 Logic Controller, Programming Guide:
 https://www.se.com/ww/en/download/document/EIO0000003059/

Modicon Controller M251 Firmware version 5.4.13.12 delivered with
EcoStruxure™ Machine Expert v2.5.0.1 includes a fix for this vulnerability and
can be installed through Schneider Electric Software Installer available here:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/

On the engineering workstation install v2.5.0.1 of EcoStruxure™ Machine
Expert. For help refer to Schneider Electric Software Installer User Guide
available here:
https://www.se.com/ww/en/download/document/EIO0000005500/

Update Modicon Controller M251 to the latest Firmware and perform reboot. For
instructions refer to Modicon M251 Logic Controller, Programming Guide:
 https://www.se.com/us/en/download/document/EIO0000003089/

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Use controllers and devices only in a protected environment to
minimize network exposure and ensure that they are not
accessible from public internet or untrusted networks.
• Ensure usage of user management and password features.
User rights are enabled by default and forced to create a strong
password at first use.
• Deactivate the Webserver after use when not needed.
• Use encrypted communication links.
• Setup network segmentation and implement a firewall to block
all unauthorized access to ports 80/HTTP and 443/HTTPS.
• Use VPN (Virtual Private Networks) tunnels if remote access is
required.
• The “Cybersecurity Guidelines for EcoStruxure Machine Expert,
Modicon and PacDrive Controllers and Associated Equipment”
provide product specific hardening guidelines.

CVE-2025-13902


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Foxboro DCS Control Software on Foxboro DCS workstations and servers. Control Core Services and all runtime software, like FCPs, FDCs, and FBMs, are not affected.

The [EcoStruxure™ Foxboro DCS](https://www.se.com/ww/en/product-range/63680-ecostruxure-foxboro-dcs/) product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation.

Failure to apply the remediation provided below may risk deserialization of untrusted data, which could result in loss of confidentiality, integrity and potential remote code execution on the compromised workstation.

Overview

Summary: Deserialization of Untrusted Data vulnerability on EcoStruxure™ Foxboro DCS - SEVD-2026-069-03 PDF Version

Summary: Deserialization of Untrusted Data vulnerability on EcoStruxure™ Foxboro DCS - SEVD-2026-069-03 CSAF Version

Summary: Original Release

Summary: Updated remediation and mitigations section.

Schneider Electric

EcoStruxure™ Foxboro DCS

EcoStruxure™ Foxboro DCS versions prior to CS8.1

CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity
and potential remote code execution on workstation when an admin authenticated user opens a malicious
project file.

CVE Description

CVSS v4.0 Base Score 7.0 | High | [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0  Score

Version CS 8.1 of EcoStruxure™ Foxboro DCS includes a fix for this vulnerability and is available through https://buyautomation.se.com/

CS 8.1 requires FX-V3 licenses, standard upgrade procedures apply. A reboot is required for workstations and servers. Depending on the existing system version, online upgrade without production interruption might be possible.

We recommend you work with your local Field Service Representative or Technical Service Consultant for further information.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

The vulnerability is attacked with manipulated data from external sources to the DCS computers. Examples for these are:
* Configuration taglists
* DirectAccess Scripts
* Any partial or full Galaxy backups
* Library files
* Code snippets
* ASCII files of any sort
* Generally, any file getting from outside the DCS computer on a DCS computer.

Only using data from trusted sources, check for correct file name endings on data files, check for reasonable file sizes for any files coming to the system, and check structured data for any fields or columns which might be unexpected.

Check for unusual manipulations of data within data files and reject files containing unexpected data or structures.

Use secure communication channels and encrypt communications when communicating outside the site network.

 Avoid and ban removable media (e.g. USB sticks or drives)

Minimize count of users with engineering or administrative rights to DCS computers and ensure all interactions on DCS computers are executed with minimal user access rights.

Consequently, isolating Foxboro DCS computers will help minimizing the risk of this vulnerability being exploited.

CVE-2026-1286


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Automation Expert product.
The EcoStruxure™ Automation Expert product is plant automation software designed for digital control systems
in discrete, hybrid and continuous industrial processes. A totally integrated automation solution designed to
enhance your flexibility, efficiency and scalability.
Failure to apply the remediation provided below may risk execution of arbitrary commands on the engineering
workstation, which could result in a potential compromise of full system.

Overview

Summary: Improper Control of Generation of Code ('Code Injection') vulnerability on EcoStruxure™ Automation Expert - SEVD-2026-069-04 PDF Version

Summary: Improper Control of Generation of Code ('Code Injection') vulnerability on EcoStruxure™ Automation Expert - SEVD-2026-069-04 CSAF Version

Summary: Original Release

Schneider Electric

EcoStruxure™ Automation Expert

EcoStruxure™ Automation Expert Versions prior to v25.0.1

EcoStruxure™ Automation Expert Version v25.0.1

CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause
execution of untrusted commands on the engineering workstation which could result in a limited compromise of
the workstation and a potential  loss of Confidentiality, Integrity and Availability of the subsequent system when
an authenticated user opens a malicious project file.

CVE Description

CVSS v4.0 Base Score 7.2 | High | [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H)

CVSS 4.0 Score

Version v25.0.1 of EcoStruxure™ Automation Expert includes a fix
for this vulnerability and is available for download here:

https://www.se.com/ww/en/product-range/23643079-ecostruxure-automation-expert/

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
Solution and archive files must be stored within the user’s home directory or in any
location protected by appropriate Windows file‑system access controls to prevent
unauthorized access in multi‑user environments. Users who choose to store files outside
their home directory are responsible for applying restrictive Windows permissions to
secure those locations.

Before opening any solution or archive file, users are required to verify its authenticity and
ensure that it has not been modified by unauthorized users.

For detailed mitigation steps, refer to the User Manual -
https://product-help.se.com/EcoStruxure%20Automation%20Expert/25.0/Offer%20Guides/en-US/EAE_UM?t=EAE_UM%2FSolutionIntegrity-FE037ED3.html%3Frhhlterm%3Dundefined%253Frhsearch%253Dundefined&theme=Help

CVE-2026-2273


Public

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a hard-coded credentials vulnerability in its EcoStruxure™ IT Data Center Expert (DCE) product that requires administrator credentials and enabling a feature (SOCKS Proxy) that is off by default.
The EcoStruxure™ IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment.
Failure to apply the remediation provided below may risk information disclosure, and remote compromise of the offer which could result in disruption of operations and access to system data.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp) if you need assistance removing a patch.

Summary: Use of Hard-coded Credentials vulnerability in EcoStruxure™ IT Data Center Expert - SEVD-2026-069-05 PDF Version

Summary: Use of Hard-coded Credentials vulnerability in EcoStruxure™ IT Data Center Expert - SEVD-2026-069-05 CSAF Version

Summary: Original Release

Schneider Electric

EcoStruxure™ IT Data Center Expert

EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert) v9.0 and prior

CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default.

CVE Description

CVSS v4.0 Base Score 7.5 | High | [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

v9.1 of EcoStruxure™ IT Data Center Expert includes a fix for this vulnerability and is available for download here:
https://www.se.com/en/product-range/61851-ecostruxure-it-data-center-expert/#software-and-firmware

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Harden the DCE instance according to the cybersecurity best practices documented in the EcoStruxure™ IT Data Center Expert Security Handbook
• Ensure the SOCKS Proxy is disabled as in the default configuration.

CVE-2025-13957


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) products. EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. EcoStruxure™ Power Operation (EPO) are on-premises software offers that provides a single platform to monitor and control medium and lower power systems.Failure to apply the fix provided below may risk local arbitrary code execution, which could result in the local system being compromised, a disruption of operations, and/or unauthorized administrative control of the system.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

EcoStruxure™ Power Operation 2022 with Advanced Reporting AND EcoStruxure™ Power Operation 2024 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You must update EcoStruxure™ Power Monitoring Expert separately from EcoStruxure™ Power Operation and apply the appropriate update for Power Monitoring Expert as described above.

Note

Summary: Deserialization of Untrusted Data vulnerability on Multiple Products - SEVD-2026-069-06 PDF Version

Summary: Deserialization of Untrusted Data vulnerability on Multiple Products - SEVD-2026-069-06 CSAF Version

Summary: Original Release

Schneider Electric

EcoStruxure™ Power Monitoring Expert (PME) Version 2022 and prior

2023 R2

EcoStruxure™ Power Monitoring Expert (PME) Version 2023 R2

2024 R2

EcoStruxure™ Power Monitoring Expert (PME) Version 2024 R2

EcoStruxure™ Power Operation (EPO) 2022 Advanced Reporting and Dashboards Module Version 2022 and prior

EcoStruxure™ Power Operation (EPO) 2024 with Advanced Reporting and Dashboards Module Version 2024

EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module

2023 R2 Hotfix_282807

EcoStruxure™ Power Monitoring Expert (PME) version 2023 R2 Hotfix_282807

2024 R2 Hotfix_279338_Release_2024R2

EcoStruxure™ Power Monitoring Expert (PME) version 2024 R2 Hotfix_279338_Release_2024R2

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with
administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe
deserialization.

CVE Description

CVSS v4.0 Base Score 8.5 | High | [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS 4.0 Score

Hotfix_279338_Release_2024R2 is available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.
No reboot required.

Customers should upgrade to EcoStruxure™ Power Monitoring Expert (PME) 2024 R3. Contact Schneider Electric’s Customer Care Center for assistance.

Hotfix_282807 - for 2023R2 is available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.
No reboot required.

Customers should upgrade to EcoStruxure™ Power Monitoring Expert (PME) 2023 R2. Once upgraded, Hotfix_282807 - for 2023R2 is available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center for assistance.

EcoStruxure™ Power Monitoring Expert (PME) 2022 version has reached its end of life and is no longer supported. • Ensure your deployment of PME has followed the cybersecurity hardening guidelines provided with the product. https://product-help.schneider-electric.com/EcoStruxure/Power-Monitoring-Expert-2024/content/2_planning/cybersecurity/cyber-planningrecactions.htm • Ensure PME is running in an isolated network • Deploy and configure the Windows firewall to limit access to appropriate network segments• Enforce complex password policies.o Review Server Access Permissions o Conduct an audit of all Windows-authenticated users who currently have access to PME. Repeat this audit of your system periodically. o Identify all accounts with access rights, especially those with elevated privileges or remote access. o Limit access to essential users only.o Revoke access for any user accounts that are not critical for system functionality or daily operations.o Apply the principle of least privilege to ensure users have only the access necessary for their role(s). Customers should also consider upgrading to the latest product offering EcoStruxure™ Power Monitoring Expert (PME) 2024 R3 to resolve this issue.

EcoStruxure™ Power Operation (EPO) 2022 version and EcoStruxure™ Power Monitoring Expert (PME) 2022 has reached its end of life and is no longer supported.  • Ensure your deployment of PME has followed the cybersecurity hardening guidelines provided with the product. https://product-help.schneider-electric.com/EcoStruxure/Power-Monitoring-Expert-2024/content/2_planning/cybersecurity/cyber-planningrecactions.htm • Ensure PME is running in an isolated network • Deploy and configure the Windows firewall to limit access to appropriate network segments• Enforce complex password policies.o Review Server Access Permissions o Conduct an audit of all Windows-authenticated users who currently have access to PME. Repeat this audit of your system periodically. o Identify all accounts with access rights, especially those with elevated privileges or remote access. o Limit access to essential users only.o Revoke access for any user accounts that are not critical for system functionality or daily operations.o Apply the principle of least privilege to ensure users have only the access necessary for their role(s). Customers should also consider upgrading to the latest product offering EcoStruxure™ Power Monitoring Expert (PME) 2024 R3 to resolve this issue.

CVE-2025-11739


Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product.
The [PowerChute Serial Shutdown](https://www.se.com/ww/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling graceful system shutdown
and energy management capabilities for desktop, servers and workstations.
Failure to apply the remediation provided below may risk improper input validation which could result in
disruption of operations and access to system data.

Overview

Summary: Multiple Vulnerabilities on PowerChute™ Serial Shutdown  - SEVD-2026-104-01 PDF Version

Summary: Multiple Vulnerabilities on PowerChute™ Serial Shutdown  - SEVD-2026-104-01 CSAF Version

Summary: Original Release

Schneider Electric

PowerChute™ Serial Shutdown

PowerChute™ Serial Shutdown Versions 1.4 and prior

PowerChute™ Serial Shutdown Version 1.5 installed on Microsoft Windows

PowerChute™ Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux

PowerChute™ Serial Shutdown Version 1.5 installed on SuSE Linux

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that
could cause critical files overwritten with text data when a Web Admin user alters the POST /REST/upssleep
request payload.

CVE Description

CVSS v4.0 Base Score 6.9 | Medium | [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here:
• Windows: https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/

Specific instructions and hardening guidelines for these mitigations can be
found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).

Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here:
• Linux:
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).

CVE-2026-2399

CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and
forged log when an attacker alters the POST /j_security check request payload.

CVE Description

CVSS v4.0 Base Score 6.9 | Medium | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2026-2404

CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an
attacker to gain access to the user account by performing an arbitrary number of authentication attempts with
different credentials on a sequence of requests to multiple endpoints.

CVE Description

CVSS v4.0 Base Score 6.9 | Medium | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2026-2402

CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting
zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout
requests.

CVE Description

CVSS v4.0 Base Score 5.3 | Medium | [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2026-2405

CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and
Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request
payload.

CVE Description

CVSS v4.0 Base Score 5.3 | Medium | [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2026-2403

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause
application user credentials to reset  when  a Web Admin user alters the POST /setPCBEDesc request
payload.

CVE Description

CVSS v4.0 Score

CVE-2026-2400

CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause  confidential
information to be exposed when a Web Admin user executes a malicious file provided by an attacker.

CVE Description

CVSS v4.0 Base Score 2.4 | Low | [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2026-2401


Public

General Security Recommendations

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a RADIUS protocol vulnerability affecting its Modicon Network Managed Switch product.
 The Modicon Network Managed Switch product provides connectivity for multiple Ethernet devices, network management, enhanced cyber security and more advanced switching features.
 Failure to apply the mitigation provided below may risk forgery attacks in RADIUS Protocol, which could result in modification of any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response which could result in the possibility of denial of service and loss of confidentiality, integrity of the devices connected to the switch.

Overview

Summary: Third-Party vulnerability on Modicon Networking Managed Switches - SEVD-2026-104-02 PDF Version

Summary: Third-Party vulnerability on Modicon Networking Managed Switches - SEVD-2026-104-02 CSAF Version

Summary: Original Release

Schneider Electric

Modicon Redundancy Switches

Modicon Redundancy Switches All Versions

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Additional information about CVE-2024-3596 can be found here:https://www.cve.org/CVERecord?id=CVE-2024-3596

CVE Description

The default RADIUS configuration is not vulnerable. However, if the RADIUS Server Message Authenticator option is disabled, the product becomes vulnerable.We advise keeping this parameter in its default (enabled) state.This parameter can be configured via CLI and SNMP:TCSESM* CLI: radius server msgauthMIB: hmAgentRadiusServerMsgAuth

The default RADIUS configuration is not vulnerable. However, if the RADIUS Server Message Authenticator option is disabled, the product becomes vulnerable.We advise keeping this parameter in its default (enabled) state.This parameter can be configured via CLI and SNMP:MCSESM*, MCSESP* CLI: radius server auth modify <index> msgauth MIB: hm2AgentRadiusServerMsgAuth

The default RADIUS configuration is not vulnerable. However, if the RADIUS Server Message Authenticator option is disabled, the product becomes vulnerable.We advise keeping this parameter in its default (enabled) state.This parameter can be configured via CLI and SNMP:MCSESR* CLI: radius server auth modify <index> msgauth MIB: hm2AgentRadiusServerMsgAuth

CVE-2024-3596


Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Easergy MiCOM Px40 Series products.
The Easergy MiCOM Px40 is a protection relay series for Medium Voltage, High Voltage and Extra High
Voltage protection.
Failure to apply the fix provided below may risk unauthorized access to the device, which could result in
exposure of device data.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp) if you need assistance removing a patch.

Note: All Easergy MiCOM Px40 models with the Ethernet option. Models with the ethernet option can be
identified using the model number as Q, R, S indicated in the 7th digit of the model number.

Summary: Use of Hard-coded Credentials vulnerability on Easergy MiCOM Px40 Series -SEVD-2026-104-03 PDF Version

Summary: Use of Hard-coded Credentials vulnerability on Easergy MiCOM Px40 Series - SEVD-2026-104-03 CSAF Version

Summary: Original Release

Schneider Electric

Easergy MiCOM P14x

Easergy MiCOM P14x All versions prior to B4A

Easergy MiCOM P24x

Easergy MiCOM P24x All versions prior to D3A

Easergy MiCOM P341

Easergy MiCOM P341 All versions prior to E3F

Easergy MiCOM P342, P343, P344, P345

Easergy MiCOM P342, P343, P344, P345 All versions prior to B3F

Easergy MiCOM P342, P343, P344, P345 version B3F

Easergy MiCOM P442, P444

Easergy MiCOM P442 P444 All versions prior to E3A

Easergy MiCOM P443, P445, P446, P543, P544, P545, P546 All versions prior to H6A

Easergy MiCOM P443, P445, P446, P543, P544, P545, P546 version H6A

Easergy MiCOM P841

Easergy MiCOM P841 All versions prior to G6A

Easergy MiCOM P643

Easergy MiCOM P643 All versions prior to B3F

Easergy MiCOM P642, P645

Easergy MiCOM P642, P645 All versions prior to B4A

Easergy MiCOM P741, P742, P743

Easergy MiCOM P741, P742, P743 All versions prior to B2A

Easergy MiCOM P741, P742, P743 version B2A

Easergy MiCOM P746

Easergy MiCOM P746 All versions prior to B4E

Easergy MiCOM P746 All versions prior to C4E

Easergy MiCOM P849

Easergy MiCOM P849 All versions prior to B4A

CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive
device information when an unauthenticated attacker is able to interrogate the SNMP port.

CVE Description

CVSS v4.0 Base Score 6.9 | Medium | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

Version B4A of MiCOM P14x Series includes a fix for this vulnerability. Contact
Schneider Electric’s Customer Care Center to download this firmware

Version D3A of MiCOM P24x Series includes a fix for this vulnerability. Contact
Schneider Electric’s Customer Care Center to download this firmware.

Version E3F of MiCOM P341 Series includes a fix for this vulnerability. Contact
Schneider Electric’s Customer Care Center to download this firmware.

Version B3F of MiCOM P342,P343,P344,P345 Series includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this firmware

Version E3A of MiCOM P442, P444 Series includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this firmware

Version H6A of MiCOM P443, P445, P446, P543, P544, P545, P546 Series includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this firmware

Version G6A of MiCOM P841 Series includes a fix for this vulnerability.Contact Schneider Electric’s Customer Care Center to download this firmware

Version B3F of MiCOM P643 Series includes a fix for this vulnerability.Contact Schneider Electric’s Customer Care Center to download this firmware.

Version B4A of MiCOM P642/P645 Series includes a fix for this vulnerability.Contact Schneider Electric’s Customer Care Center to download this firmware

Version B2A of MiCOM P741/2/3 Series includes a fix for this vulnerability.Contact Schneider Electric’s Customer Care Center to download this firmware

Version B4E/C4E of MiCOM P746 Series includes a fix for this vulnerability.Contact Schneider Electric’s Customer Care Center to download this firmware.

Version B4A of MiCOM P849 Series includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this firmware.

Block the SNMP service port (typically UDP/161) to reduce unnecessary
exposure.

CVE-2026-4832