Public

We strongly recommend the following industry cybersecurity best practices.
* Passwords should include upper case, lower case, number and special characters, a length of 20 characters is ideal.
* A default Admin password must be changed immediately when first received and after a factory reset.
* Device should only be used in a personal home network.
* Device should not have a publicly accessible IP address.
* Do NOT use port forwarding to access a device from the public internet.
* A device should be on its own network segment. If your router supports a guest network or VLAN, it is preferable to locate the device there.
* Use the strongest Wi-Fi encryption available, such as WPA3 or WPA2/3 with protected management frames.
* Schedule regular reboots of your routing device, smartphones, and computers.
* Ensure that unauthorized individuals cannot gain physical access to your devices (USB or LAN ports should be easily accessible.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices https://www.se.com/us/en/download/document/7EN52-0390/ document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

About Schneider Electric

Schneider Electric is aware of a vulnerability disclosed in the Silicon Labs Gecko Bootloader used in the Wiser
AvatarOn 6K Freelocate and Wiser Cuadro H 5P Socket products.

The Wiser AvatarOn 6K Freelocate https://www.se.com/sg/en/product/E8334RWMZB_WE/wiser-avataron-battery-powered-pushbutton-4k-white/ and Wiser Cuadro H 5P Socket https://www.se.com/nz/en/product/PDL395CSG/grid-wiser-connected-double-socket-iconic-smart-10a-ble-default-240v/ are home automation products.

Failure to apply the mitigations provided below may risk buffer overflow vulnerability, which could result in
persistent code execution of the attacker’s code.

Overview

Vulnerability Details

Summary: Wiser Home Automation - SEVD-2025-133-02 PDF Version

Summary: Wiser Home Automation - SEVD-2025-133-02 CSAF Version

Wiser Home Automation

Summary: Original Release

Schneider Electric

Wiser AvatarOn 6K Freelocate

Schneider Electric Wiser AvatarOn 6K Freelocate All versions

Wiser Cuadro H 5P Socket

Schneider Electric Wiser Cuadro H 5P Socket All versions

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects 'Standalone' and 'Application' versions of Gecko Bootloader.

CVE Description

The Wiser AvatarOn 6K Freelocate and Wiser Cuadro H 5P Socket
products have reached their end of life and are no longer supported.
Customers should immediately either disable the firmware update in the
Zigbee Trust Center or remove the products from service to reduce the
risk of exploit.

CVE-2023-4041


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Build Rapsody software.
EcoStruxure Power Build Rapsody product is used to enter or import the single line diagram, to get the
extensive bill of material of switchboards, including all devices, connection items, and mounting components.
Failure to apply the remediations provided below may risk memory corruption, heap-based buffer overflow,
stack-based buffer overflow, which could result in local attackers being able to exploit these issues to
potentially execute arbitrary code.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Summary: EcoStruxure Power Build Rapsody - SEVD-2025-133-03 PDF Version

Summary: EcoStruxure Power Build Rapsody - SEVD-2025-133-03 CSAF Version

EcoStruxure Power Build Rapsody

Summary: Original Release

Schneider Electric

<=2.7.12 FR

Schneider Electric EcoStruxure™ Power Build Rapsody software Version 2.7.12 FR and prior

2.8.1 FR

Schneider Electric EcoStruxure™ Power Build Rapsody software Version 2.8.1 FR

CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to
exploit these issues to potentially execute arbitrary code while the end user opens a malicious project file (SSD
file) provided by the attacker.

CVE Description

Version v2.8.1 FR of EcoStruxure™ Power Build–Rapsody includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/2309-ecostruxure-power-buildrapsody/#overview
Please reboot after installing the new version.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Store the project files in a secure storage and restrict
the access to only trusted users
• When exchanging files over the network, use secure
communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly
check the consistency of this hash to verify the
integrity before usage
• Harden the workstation running EcoStruxure™ Power Build Rapsody
To ensure you are informed of all updates, including details on affected products
and remediation plans, subscribe to Schneider Electric’s security notification
service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

CVE-2025-3916


Public

We strongly recommend the following industry cybersecurity best practices.
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices https://www.se.com/us/en/download/document/7EN52-0390/ document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

 Customers should use appropriate patching methodologies when applying these patches to their systems. We
strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and
Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if
you need assistance removing a patch.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability disclosed in the Silicon Labs Gecko Bootloader used in the
PrismaSet Active - Wireless Panel Server.

The PrismaSeT Active - Wireless Panel Server https://www.se.com/ww/en/product-range/39982243-prismaset-p-active/#products product is the latest generation of low-voltage switchboards,

natively connected to the cloud.
Failure to apply the mitigations provided below may risk unauthorized code execution, which could result in the
unavailability of the Prisma SeT Active Wireless Panel Server for Voltage loss monitoring.

Overview

Vulnerability Details

Summary: Schneider Electric PrismaSeT Active - Wireless Panel Server - SEVD-2025-133-04 PDF Version

Summary: Schneider Electric PrismaSeT Active - Wireless Panel Server - SEVD-2025-133-04 CSAF Version

Summary: Original Release

Schneider Electric PrismaSeT Active - Wireless Panel Server All versions

CVE Description

PrismaSeT Active - Wireless Panel Server product has reached its end of life and
is no longer supported.

Customers should immediately apply the following mitigations to reduce the risk
of exploit:
* Deactivate Bluetooth Low (BLE) communication of Wireless Panel Server
when it is not in use.
* Periodically review audit logs and/or EcoStruxure™ Facility Expert App
security notifications to detect unexpected behaviors.
* Regularly check the physical security of the Wireless Panel Server to
protect against unauthorized Bluetooth pairing.
* Use only Schneider Electric official EcoStruxure™ Power Commission
App and EcoStruxure™ Facility Expert App available in Google Play Store
and Apple App Store.
* Do not use EcoStruxure Power Commission App and EcoStruxure™
Facility Expert App in rooted or jail-broken mobile devices.
* Follow PrismaSeT Active - Wireless Panel Server Cybersecurity Recommendations https://www.productinfo.schneider-electric.com/wirelesspanelserverguide/viewer?docidentity=TPC_PanelServerCybersecurityRecomme-3453D816&lang=en&extension=xml&manualidentity=UserGuideWirelessPanelServerWHENPUB-5475323F

CVE-2023-4041


Public

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

 Customers should use appropriate patching methodologies when applying these patches to their systems. We
strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and
Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if
you need assistance removing a patch.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability disclosed on the Erlang/OTP's SSH Server
 component used Schneider Electric Galaxy VS, VL, and VXL.Many vendors, including Schneider Electric, embed the Erlang/OTP's SSH Server in their offers.The Galaxy VS, Galaxy VL, Galaxy VXL products are 3-phase UPS for data centers and other business critical applications.Failure to apply the mitigation provided below may risk unauthenticated remote code execution (RCE), which could impact the monitoring capabilities of the UPS and potential UPS operation.

Overview

A vulnerability disclosed by Erlang/OTP's SSH Server impacts SSH component used on the Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL.
 CVE ID: CVE-2025-32433
Additional information about the vulnerability CVE-2025-32433 can be found in the https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2.

Vulnerability Details

Summary: Galaxy VS, Galaxy VL, Galaxy VXL - SEVD-2025-133-05 PDF Version

Summary: Galaxy VS, Galaxy VL, Galaxy VXL - SEVD-2025-133-05 CSAF Version

Summary: GitHub Security Advisory

Galaxy VS, Galaxy VL, Galaxy VXL

Summary: Original Release

Summary: Remediations are now available for Galaxy VS, Galaxy VL, and Galaxy VXL

Summary: Added missing CVE and CWE

Schneider Electric

Galaxy VS

Schneider Electric Galaxy VS Version v6.118.0 and prior

Schneider Electric Galaxy VS Version v6.123.0

Galaxy VL

Schneider Electric Galaxy VL Version v18.5.0 and prior

Schneider Electric Galaxy VL Version v18.10.0

Galaxy VXL

Schneider Electric Galaxy VXL Version v15.21.0 and prior

Schneider Electric Galaxy VXL Version v15.29.0

Missing Authentication for Critical Function

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.

CVE Description

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
1. Log on to the NMC4 via the Web Interface. Once logged into the system, navigate to the
Console settings page from the menu bar by selecting Configuration -> Network ->
Console -> Access
2. From the Console setting screen, uncheck the enable SSH/SFTP/SCP check box ->
Click Apply
As an alternative, setup network segmentation and implement a firewall to block all
unauthorized access to SSH port 22/TCP.
If assistance is needed applying the above mitigation, please contact our technical support
team: https://www.se.com/ww/en/work/support/
To learn more, we recommend reviewing the Network Management Card 4 Security Handbook
for specific actions available here to secure your devices further:
https://www.se.com/us/en/download/document/SPD_CCON-B8EJSJ_EN/
To ensure you are informed of all updates, including details on affected products and
remediation plans, subscribe to Schneider Electric's security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

Version 6.123.0 of Galaxy VS includes a fix for this vulnerability and is available through your local FSR by contacting Schneider Electric's Customer Care Center.

Version 18.10.0 of Galaxy VL includes a fix for this vulnerability and is available through your local FSR by contacting Schneider Electric's Customer Care Center.

Version 15.29.0 of Galaxy VXL includes a fix for this vulnerability and is available through your local FSR by contacting Schneider Electric's Customer Care Center.

CVE-2025-32433


Public

We strongly recommend the following industry cybersecurity best practices.
* Customers should configure their home routers securely and use appropriate patching methodologies on a regular basis.
* Passwords should include upper case, lower case, number and special characters, a length of 20 characters is ideal.
* A default Admin password must be changed immediately when first received and after a factory reset.
* Device should only be used in a personal home network with a secured router device with firewall turned on.
* Device should not have a publicly accessible IP address (use private IP ranges 10.x.x.x/8 or 172.16.x.x/12, or 192.168.x.x/16)
* Do NOT use port forwarding to access a device from the public internet.
* A device should be on its own network segment. If your router supports a guest network or VLAN, it is preferable to locate the device there.
* Use the strongest Wi-Fi encryption available, such as WPA3 or WPA2/3 with protected management frames.
* Schedule regular reboots of your routing device, smartphones, and computers.
* Ensure that unauthorized individuals cannot gain physical access to your devices (USB or LAN ports should be easily accessible).

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION.

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

About Schneider Electric

Schneider Electric is aware of a vulnerability in a third-party Real-Time Operating System (RTOS) component
utilized in the Insight Home and Insight Facility products.

The Insight Home https://www.se.com/ww/en/product/865-0330/insighthome-smart-edge-device-for-smaller-residential-systems-with-up-to-6-power-devices/?range=66298-insight-energy-management&selectedNodeId=99009568934 and Insight Facility https://www.se.com/ww/en/product/865-0335/insightfacility-smart-edge-device-for-larger-residential-and-small-commercial-applications/?range=66298-insight-energy-management&selectedNodeId=99009568934 are smart edge devices designed to operate within a secure local
network environment.

Failure to apply the mitigations provided below may risk could result in improper operation of the device and
loss of data.

As outlined in the user manual, users are explicitly instructed to connect these devices to a home router and to
avoid exposing them directly to the internet. Adhering to this guidance significantly reduces the risk associated
with the identified vulnerability. Schneider Electric remains committed to the security and reliability of its
products and continues to monitor and assess potential risks associated with third-party components.

Overview

Summary: Insight Home and Insight Facility - SEVD-2025-161-01 PDF Version

Summary: Insight Home and Insight Facility - SEVD-2025-161-01 CSAF Version

Insight Home and Insight Facility

Summary: Original Release

Schneider Electric

Insight Home

Schneider Electric Insight Home All versions

Insight Facility

Schneider Electric Insight Facility All versions

OpenSSL v1.0.2 library built into the QNX operating system v6.6 used in the Insight Home and Insight Facility
products is known to contain multiple high and critical vulnerabilities. OpenSSL vulnerabilities exist in all Insight
Home and Insight Facility due to the fundamental attributes of the QNX operating system v6.6.

Vulnerability Details

Due to limitations of the Insight Home and Insight Facility hardware, the QNX operating system v6.6 cannot be
updated for the devices listed.
The Insight Home and Insight Facility products have reached their end of life and are
no longer supported.

Due to limitations of the Insight Home and Insight Facility hardware, the QNX operating system v6.6 cannot be
updated for the devices listed.
Customers should immediately apply the mitigations below to reduce the risk of
exploitation:
* Device should only be used in a personal home network with a secured
router device with firewall turned on.
* Device should not have a publicly accessible IP address (use private IP
ranges 10.x.x.x/8 or 172.16.x.x/12, or 192.168.x.x/16)
* Do NOT use port forwarding to access a device from the public internet.
* Do NOT place devices directly on the Internet.


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M241 / M251 / M258 / LMC058
/ M262 products.

The Modicon Controllers M241/M251/M258/M262 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products are Programmable Logic
Controllers for performance-demanding applications.

Failure to apply remediation/mitigations provided below may risk Cross-Site Scripting, Denial of Service or
uncontrolled resource consumption which could result in loss of confidentiality, integrity and availability of the
controller.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0) https://www.first.org/cvss/calculator/4.0 . CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp if you need assistance removing a patch.

Summary: Modicon Controllers M241/M251/M258/LMC058/M262 - SEVD-2025-161-02 PDF Version

Summary: Modicon Controllers M241/M251/M258/LMC058/M262 - SEVD-2025-161-02 CSAF Version

Summary: Original Release

Summary: A remediation is now available within EcoStruxure™ Machine Expert v2.3 used to update the M241/M251 firmware.

Schneider Electric

Modicon Controllers M241

Schneider Electric Modicon Controllers M241 Versions prior to 5.3.12.51

Modicon Controllers M251

Schneider Electric Modicon Controllers M251 Versions prior to 5.3.12.51

Modicon Controllers M262

Schneider Electric Modicon Controllers M262 Versions prior to 5.3.9.18

Modicon Controllers M258

Schneider Electric Modicon Controllers M258 All versions

Modicon Controllers LMC058

Schneider Electric Modicon Controllers LMC058 All versions

EcoStruxure Machine Expert

Schneider Electric Modicon Controllers M241 Version 5.3.12.51 installed on Schneider Electric EcoStruxure™ Automation Expert - Motion Version 24.1

Schneider Electric Modicon Controllers M251 Version 5.3.12.51 installed on Schneider Electric EcoStruxure™ Automation Expert - Motion Version 24.1

Schneider Electric Modicon Controllers M262 Versions from 5.3.9.18 installed with Schneider Electric EcoStruxure™ Automation Expert - Motion Version 24.1

Schneider Electric Modicon Controllers M241 Version 5.3.12.51 installed on Schneider Electric EcoStruxure™ Machine Expert Version 2.3

Schneider Electric Modicon Controllers M251 Version 5.3.12.51 installed on Schneider Electric EcoStruxure™ Machine Expert Version 2.3

Schneider Electric Modicon Controllers M262 Versions from 5.3.9.18 installed on Schneider Electric EcoStruxure™ Machine Expert Version 2.3

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an
authenticated malicious user sends HTTPS request containing invalid data type to the webserver.

CVE Description

Version 5.3.12.51 of Modicon Controllers M241 includes a fix for
these vulnerabilities and can be downloaded here:
M241:https://www.se.com/ww/en/product-range/62129-modicon-m241-micro-plc/#software-and-firmware
•Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion
v24.1 or EcoStruxure™ Machine Expert v2.3 to update the M241 firmware and
perform a reboot.
 •EcoStruxure™ Automation Expert – Motion V24.1 is available via the
Schneider Electric Software Installer:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
• Additional information is available in the Quick Start Guide, chapter “EcoStruxure™
Automation Expert Platform Installation”.

Version 5.3.12.51 of Modicon Controllers M251 includes a fix for
these vulnerabilities and can be downloaded here:
M251:https://www.se.com/ww/en/product-range/62130-modicon-m251-micro-plc-with-dual-channel-comm/#software-and-firmware
•Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion
v24.1 or EcoStruxure™ Machine Expert v2.3 to update the M251 firmware and
perform a reboot.
 •EcoStruxure™ Automation Expert – Motion V24.1 is available via the
Schneider Electric Software Installer:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
• Additional information is available in the Quick Start Guide, chapter “EcoStruxure™
Automation Expert Platform Installation”.

Versions from 5.3.9.18 of Modicon Controllers M262 include a fix for these
vulnerabilities and can be downloaded here:
https://www.se.com/ww/en/product-range/65771-logic-motion-controllermodicon-m262/#software-and-firmware
•Use the Controller Assistant feature of EcoStruxure™ Automation Expert – Motion v24.1or EcoStruxure™ Machine Expert v2.3 to update the M262 firmware and perform a reboot.
 •EcoStruxure™ Automation Expert – Motion V24.1 is available via the
Schneider Electric Software Installer:
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER.
• Additional information is available in the Quick Start Guide, chapter “EcoStruxure™
Automation Expert Platform Installation”.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
* Use controllers and devices only in a protected environment to
minimize network exposure and ensure that they are not
accessible from public internet or untrusted networks.
* Ensure usage of user management and password features. User
rights are enabled by default and forced to create a strong
password at first use.
* Deactivate the Webserver after use when not needed.
* Use encrypted communication links.
* Setup network segmentation and implement a firewall to block all
unauthorized access to ports 80/HTTP and 443/HTTPS.
* Use VPN (Virtual Private Networks) tunnels if remote access is
required.
* The “Cybersecurity Guidelines for EcoStruxure Machine Expert,
Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
provide product specific hardening guidelines.

CVE-2025-3898

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated
malicious user leading to modify or read data in a victim’s browser.

CVE Description

CVE-2025-3899

CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an
authenticated malicious user sends manipulated HTTPS Content-Length header to the webserver.

CVE Description

CVE-2025-3112

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
exists impacting PLC system variables that could cause an unvalidated data injected by authenticated
malicious user leading to modify or read data in a victim’s browser.

CVE Description

Schneider Electric is establishing a remediation plan for all future versions
of Modicon M258/LMC058 that will include a fix for this vulnerability. We
will update this document when the remediation is available. Until then,
customers should immediately apply the following mitigations to reduce
the risk of exploit:
* Use controllers and devices only in a protected environment to
minimize network exposure and ensure that they are not
accessible from public internet or untrusted networks.
* Ensure usage of user management and password features. User
rights are enabled by default and forced to create a strong
password at first use.
* Deactivate the Webserver after use when not needed.
* Use encrypted communication links.
* Setup network segmentation and implement a firewall to block all
unauthorized access to ports 80/HTTP and 443/HTTPS.
* Use VPN (Virtual Private Networks) tunnels if remote access is
required.
* The “Cybersecurity Guidelines for EcoStruxure Machine Expert,
Modicon and PacDrive Controllers and Associated Equipment” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
provide product specific hardening guidelines.

CVE-2025-3905

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an
authenticated malicious user sends special malformed HTTPS request containing improper formatted body
data to the controller.

CVE Description

CVE-2025-3116

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
exists impacting configuration file paths that could cause an unvalidated data injected by authenticated
malicious user leading to modify or read data in a victim’s browser.

CVE Description

CVE-2025-3117


Public

We strongly recommend the following industry cybersecurity best practices.
* Passwords should include upper case, lower case, number and special characters, a length of 20 characters is ideal.
* A default Admin password must be changed immediately when first received and after a factory reset.
* Device should only be used in a personal home network.
* Device should not have a publicly accessible IP address.
* Do NOT use port forwarding to access a device from the public internet.
* A device should be on its own network segment. If your router supports a guest network or VLAN, it is preferable to locate the device there.
* Use the strongest Wi-Fi encryption available, such as WPA3 or WPA2/3 with protected management frames.
* Schedule regular reboots of your routing device, smartphones, and computers.

 For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices https://www.se.com/us/en/download/document/7EN52-0390/ document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

 Customers should use appropriate patching methodologies when applying these patches to their systems. We
strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and
Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if
you need assistance removing a patch.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EVLink WallBox product.

The EVLink WallBox https://www.se.com/ww/en/product-range/62395-evlink-wallbox/%23products  is a charging station for electric vehicles at home or on private property, suitable for
indoor and outdoor use.

Failure to apply the mitigations provided below may risk arbitrary file read, cross-site scripting and remote code
execution from a user with authenticated access to the web server, which could result in information
disclosure, service interruption, and gain full control of the charging station.

Overview

Summary: EVLink WallBox - SEVD-2025-161-03 PDF Version

Summary: EVLink WallBox - SEVD-2025-161-03 CSAF Version

EVLink WallBox

Summary: Original Release

Summary: Updated vulnerability details for CVE-2025-5740 as the vulnerability requires the attacker to be authenticated.

Schneider Electric

EVLink WallBox

Schneider Electric EVLink WallBox All versions

Dutch Institute for Vulnerability Disclosure (DIVD)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that
could cause arbitrary file writes when an authenticated user on the web server manipulates file path.

CVE Description

EVLink WallBox product has reached its end of life and is no longer supported. Customers should also consider upgrading to the replacement product offering EVLink Pro AC https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#products to resolve these issues.

Customers should immediately apply the following mitigations to reduce the risk of
exploit:
* Firewall configuration & logs:

	o Setup network segmentation and implement a firewall to block all
unauthorized access to HTTP ports

	o Check the access log periodically
* Password:

	o Choose a strong password

	o Do not share your password

	o Change your password periodically

Customers should also consider upgrading to the replacement product offering
EVLink Pro AC https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#products to resolve these issues.

CVE-2025-5740

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause
arbitrary file reads from the charging station. The exploitation of this vulnerability does require an authenticated
session of the web server.

CVE Description

CVE-2025-5741

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulnerability exists when an authenticated user modifies configuration parameters on the web server

CVE Description

CVE-2025-5742

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could
cause remote control over the charging station when an authenticated user modifies configuration parameters
on the web server.

CVE Description

CVE-2025-5743


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ IT Data Center Expert (DCE)
product.
The EcoStruxure™ IT Data Center Expert product is a scalable monitoring software that collects, organizes,
and distributes critical device information providing a comprehensive view of equipment.
Failure to apply the remediation provided below may risk information disclosure, and remote compromise of
the offer which could result in disruption of operations and access to system data.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0) https://www.first.org/cvss/calculator/4.0 . CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp if you need assistance removing a patch.

EcoStruxure™ IT Data Center Expert is Formerly known as StruxureWare Data Center Expert

Summary: EcoStruxure™ IT Data Center Expert - SEVD-2025-189-01 PDF Version

Summary: EcoStruxure™ IT Data Center Expert - SEVD-2025-189-01 CSAF Version

EcoStruxure™ IT Data Center Expert

Summary: Original Release

Schneider Electric

EcoStruxure™ IT Data Center Expert

Schneider Electric EcoStruxure™ IT Data Center Expert Version 8.3 and prior

Schneider Electric EcoStruxure™ IT Data Center Expert Version 9.0

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created
over the web interface HTTP when enabled. HTTP is disabled by default.

CVE Description

Version 9.0 of EcoStruxure™ IT Data Center Expert includes fixes
for these vulnerabilities and is available upon request from
Schneider Electric’s Customer Care Center.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Harden the DCE instance according to the cybersecurity best practices documented in the
EcoStruxure™ IT Data Center Expert Security Handbook

CVE-2025-50121

CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the
password generation algorithm is reverse engineered with access to installation or upgrade artifacts.

CVE Description

CVE-2025-50122

CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote
command execution by a privileged account when the server is accessed via a console and through
exploitation of the hostname input.

CVE Description

CVE-2025-50123

CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote
code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation
of host request header.

CVE Description

CVE-2025-50125

CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the
server is accessed by a privileged account via a console and through exploitation of a setup script.

CVE Description

CVE-2025-50124

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could
cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access
when the server is accessed via the network using an application account.

CVE Description

CVE-2025-6438


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

About Schneider Electric

Schneider Electric is aware of a vulnerability in its System Monitor application of Harmony Industrial PC and
Pro-face PS5000 trusted Legacy industrial PC series products.
The Harmony Industrial PC Series and Pro-face PS5000 legacy industrial PC Series are iPCs which
incorporate slim, flexible and durable design allowing each customer to configure their iPC based on their
individual application needs. These products offer flexible connectivity to a range of devices and designs.
Failure to apply the remediations provided below may risk untrusted code execution which could result in
operational failures.

Overview

Vulnerability disclosed by GitHub in the jQuery product impacts Schneider Electric HMI products.
Additional information about the vulnerability can be found in CVE.org portal:
jQuery CVE Record: CVE-2020-11023 https://www.cve.org/CVERecord?id=CVE-2020-11023

Vulnerability Details

Summary: System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs - SEVD-2025-189-02 PDF Version

Summary: System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs - SEVD-2025-189-02 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Summary: GitHub Advisory

Summary: Original Release

Schneider Electric

Harmony Industrial PC

HMIBMO HMIBMI HMIPSO HMIBMP HMIBMU HMIPSP HMIPEP

Pro-face Industrial PC

Schneider Electric System Monitor application installed on Schneider Electric Harmony Industrial PC All Versions

Schneider Electric System Monitor application installed on Schneider Electric Pro-face Industrial PC All Versions

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE Description

Customer can uninstall System Monitor application using installer
available for download here:
https://www.se.com/ww/en/product-range/61054-
harmony-industrial-pc/#software-and-firmware
Please follow the steps described in the guideline attached as a .pdf
in the downloaded uninstaller guide.

Customer can uninstall System Monitor application using installer
available for download here:
https://www.proface.com/en/product/ipc/ps5000/download
Please follow the steps described in the guideline attached as a .pdf
in the downloaded uninstaller guide.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations
to reduce the risk of exploit:
• Stop the system monitor if not required by turning off the services as specified in user guide:
o Harmony Industrial PC Series User Manual
• Setup network segmentation and implement a firewall to block all unauthorized access
to configured HTTP/HTTPS ports.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations
to reduce the risk of exploit:
• Stop the system monitor if not required by turning off the services as specified in user guide:
o Pro-face PS5000 legacy industrial PC Series User Manual
• Setup network segmentation and implement a firewall to block all unauthorized access
to configured HTTP/HTTPS ports.

CVE-2020-11023


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities disclosed in PostgreSQL.

Many vendors, including Schneider Electric, use PostgreSQL in their offers. PostgreSQL is a
database server that is used as a data store for multiple products.

Schneider Electric installs a version of PostgreSQL with its EcoStruxure™ Power Operation https://www.se.com/us/en/product-range/65405-ecostruxure-power-operation/?parent-subcategory-id=59326966&filter=business-4-low-voltage-products-and-systems#overview software.

EcoStruxure™ Power Operation (EPO) is an on-premises software offer that provides a single
platform to monitor and control medium and lower power systems.

Failure to apply the remediations and mitigations below could result in loss of system
functionality or unauthorized access to system functions.

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

A number of transitive vulnerabilities in PostgreSQL pgadmin tool could impact EcoStruxure™ Power Operation software. Please refer to the following CVEs:
• CVE-2023-50447
• CVE-2024-28219
• CVE-2022-45198
• CVE-2023-5217
• CVE-2023-35945
• CVE-2023-44487

 Additional information about these vulnerabilities can be found on https://www.cve.org/

Vulnerability Details

Summary: EcoStruxure™ Power Operation - SEVD-2025-189-03 PDF Version

Summary: EcoStruxure™ Power Operation - SEVD-2025-189-03 CSAF Version

EcoStruxure™ Power Operation

Summary: Original Release

Summary: Remediations are now available for EcoStruxure™ Power Operation 2022. Vulnerability details and remediation directions have been updated as well.

Schneider Electric

EcoStruxure™ Power Operation (EPO)

EcoStruxure™ Power Operation (EPO) 2022 CU6 and prior

EcoStruxure™ Power Operation (EPO) 2024 CU1 and prior

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

CVE Description

The CVE's listed above affect the PostgresSQL pgadmin tool. If you have installed this tool, not required by EcoStruxure™ Power Operation 2024, we recommend you uninstall it from your EPO server and client machines. We strongly recommend customers take the following actions:• If waveform analysis and ETAP simulation features are not used, uninstall PostgreSQLOR• For those customers using waveform analysis and ETAP simulation features, we recommend all deployments of EPO only accept connections from localhost in PostgresSQL. Contact customer care for information on how to modify PostgreSQL. Further, we recommend you manually uninstall PostgreSQL 14.10 and update to PostgreSQL 14.17 or higher. EcoStruxure™ Power Operation 2024 CU2 includes an updated version of PostgreSQL and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2024-Release-amp-Updates-Install-Procedure/m-p/478928/thread-id/6997#M6997

EcoStruxure™ Power Operation 2022 CU7 includes an updated version of PostgreSQL and is available for download here:https://community.se.com/t5/EcoStruxure-Power-Operation/v2022-Release-amp-Updates-Install-Procedure/m-p/491544#M7322. We strongly recommend customers take the following actions:• If waveform analysis and ETAP simulation features are not used, uninstall PostgreSQLOR• For those customers using waveform analysis and ETAP simulation features, we recommend all deployments of EPO only accept connections from localhost in PostgresSQL. Contact customer care for information on how to modify PostgreSQL. Further, we recommend you manually uninstall PostgreSQL 14.10 and update to PostgreSQL 14.17 or higher. The CVE’s listed above affect the PostgresSQL pgadmin tool. If you have installed this tool, which is not required by EcoStruxure™ Power Operation 2022, ensure you have updated it to the latest version.

CVE-2023-50447

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

CVE Description

The CVE’s listed above affect the PostgresSQL pgadmin tool. If you have installed this tool, not required by EcoStruxure™ Power Operation 2024, we recommend you uninstall it from your EPO server and client machines.We strongly recommend customers take the following actions:• If waveform analysis and ETAP simulation features are not used, uninstall PostgreSQLOR• For those customers using waveform analysis and ETAP simulation features, we recommend all deployments of EPO only accept connections from localhost in PostgresSQL. Contact customer care for information on how to modify PostgreSQL. Further, we recommend you manually uninstall PostgreSQL 14.10 and update to PostgreSQL 14.17 or higher. EcoStruxure™ Power Operation 2024 CU2 includes an updated version of PostgreSQL and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2024-Release-amp-Updates-Install-Procedure/m-p/478928/thread-id/6997#M6997

CVE-2024-28219

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

CVE Description

CVE-2022-45198

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE Description

The CVE's listed above affect the PostgresSQL pgadmin tool. If you have installed this tool, not required by EcoStruxure™ Power Operation 2024, we recommend you uninstall it from your EPO server and client machines.We strongly recommend customers take the following actions:• If waveform analysis and ETAP simulation features are not used, uninstall PostgreSQLOR• For those customers using waveform analysis and ETAP simulation features, we recommend all deployments of EPO only accept connections from localhost in PostgresSQL. Contact customer care for information on how to modify PostgreSQL. Further, we recommend you manually uninstall PostgreSQL 14.10 and update to PostgreSQL 14.17 or higher. EcoStruxure™ Power Operation 2024 CU2 includes an updated version of PostgreSQL and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2024-Release-amp-Updates-Install-Procedure/m-p/478928/thread-id/6997#M6997

CVE-2023-5217

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.

CVE Description

CVE-2023-35945

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE Description

CVE-2023-44487


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and
EcoStruxure™ Power Operation (EPO) products.
EcoStruxure™ Power Monitoring Expert (PME) https://www.se.com/us/en/product-range/65404-ecostruxure-power-monitoring-expert/#overview is an on-premises software used to help power critical and
energy-intensive facilities maximize uptime and operational efficiency. Note: There are some instances of PME
being deployed in a Managed Service model.
EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) https://www.se.com/us/en/product-range/65405-ecostruxure-power-operation/?parent-subcategory-id=59326966&filter=business-4-low-voltage-products-and-systems#overview are on-premises
software offers that provides a single platform to monitor and control medium and lower power systems.
Failure to apply the remediation provided below may risk unintended data exposure to other authenticated
users on that system.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

This vulnerability only affects multi-tenant deployments of PME (Manage Service or multi-tenant on
premises); or multitenant deployments of EPO (on premises only deployments of EPO with the Advance
Reports and Dashboards Module in a multi-tenant use case). Data exposure is limited to anything a user has
elected to include in a TGML diagram, if TGML diagrams have been used.

Vulnerability Details

EcoStruxure™ Power Operation 2022 with Advanced Reporting AND EcoStruxure™ Power Operation 2024 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You must update EcoStruxure™ Power Monitoring Expert separately from EcoStruxure™ Power Operation and apply the appropriate update for Power Monitoring Expert as described above.

Summary: EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) with Advanced Reporting and Dashboards - SEVD-2025-189-04 PDF Version

Summary: EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) with Advanced Reporting and Dashboards - SEVD-2025-189-04 CSAF Version

Summary: Original Release

Schneider Electric

2023 R2

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) Version 2023 R2

2024 R2

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) Version 2024 R2

Schneider Electric EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Version 2022 w/ Advanced Reporting Module

Schneider Electric EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Version 2024 w/ Advanced Reporting Module

2023 Hotfix_199767

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) version 2023 Hotfix_199767

2023 R2 Hotfix_199767

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) version 2023 R2 Hotfix_199767

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) version 2024 Hotfix_256448_Diagrams-Release.13.0.25182.01

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) version 2024 R2 Hotfix_256448_Diagrams-Release.13.1.25182.01

CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources
to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML
diagrams.

CVE Description

Hotfix_199767 is available for EcoStruxure™ Power
Monitoring Expert (PME) that includes a fix for this
vulnerability.
Contact Schneider Electric’s Customer Care Center to
download this hotfix.

Hotfix_256448_Diagrams-Release.13.0.25182.01
Contact Schneider Electric’s Customer Care Center to
download this hotfix.

Hotfix_256448_Diagrams-Release.13.1.25182.01 available
for EcoStruxure™ Power Monitoring Expert (PME) that
includes a fix for this vulnerability.
Contact Schneider Electric’s Customer Care Center to
download this hotfix.

Hotfix_199767 available for EcoStruxure™ Power
Monitoring Expert (PME) that includes a fix for this
vulnerability.
Contact Schneider Electric’s Customer Care Center to
download this hotfix.

Hotfix_256448_Diagrams-Release.13.0.25182.0 available
for EcoStruxure™ Power Monitoring Expert (PME) that
includes a fix for this vulnerability.
Contact Schneider Electric’s Customer Care Center to
download this hotfix.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigation to reduce the risk of exploit:
• We recommend you remove your TGML diagrams from your multitenant managed system or onpremises system and revert to using Vista diagrams.

CVE-2025-6788


Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Saitel DR & Saitel DP RTU (Remote Terminal Unit)
products.
The Saitel DR RTU is a field device, offering a solid and powerful platform for data acquisition, communication,
automation and IED integration for distribution and transmission networks, generation sector and railway.
The Saitel DP RTU is a modular platform for medium voltage and low voltage public distribution and
transmission network management.
Failure to apply the remediations provided below may risk arbitrary code execution & privilege escalation which
could result in denial of service, loss of confidentiality, and integrity of the device.

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (https://www.first.org/cvss/calculator/4-0). CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment.

Summary: Saitel DR & Saitel DP Remote Terminal Unit - SEVD-2025-224-01 PDF Version

Summary: Saitel DR & Saitel DP Remote Terminal Unit - SEVD-2025-224-01 CSAF Version

Summary: Original Release

Summary: Fixed Remediation URL.

Summary: A remediation is available for Saitel DP RTU.

Schneider Electric

Saitel DR RTU

Saitel DR RTU Versions 11.06.29 and prior

Saitel DP RTU

Saitel DP RTU Versions 11.06.34 and prior

HUe Firmware installed on Saitel DR RTU Version 11.06.30

Firmware SM_CPU866e installed on Saitel DP RTU Version 11.06.35

CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and
arbitrary code execution when a privileged engineer user with console access modifies a configuration file
used by a root-level daemon to execute custom scripts.

CVE Description

HUe Firmware version 11.06.30 includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=62685#software-and-firmware

Firmware SM_CPU866e version 11.06.35 includes a fix forthis vulnerability and is available for download here: https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61747#software-and-firmware .A reboot is needed to complete the firmware upgrade.

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Limit physical or console access to trusted users only
• Ensure that configuration files used by privileged daemons are owned by root, not writable by nonprivileged users, and set to minimum permissions when technically feasible to prevent unauthorized
modification.

CVE-2025-8453


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Power Monitoring Expert (PME) and
EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) products.
EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power critical and
energy-intensive facilities maximize uptime and operational efficiency. Note: There are some instances of PME
being deployed in a Managed Service model.
EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) are on-premises
software offers that provides a single platform to monitor and control medium and lower power systems.
Failure to apply the remediation and/or mitigations provided below may risk deserialization of untrusted data,
server-side request forgery and/or path traversal that could result in remote code execution, and/or
unauthorized access to sensitive data.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp) if you need assistance removing a patch.

NOTE: EcoStruxure™ Power Operation 2022 with Advanced Reporting AND EcoStruxure™ Power Operation 2024 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You must update EcoStruxure™ Power Monitoring Expert separately from EcoStruxure™ Power Operation and apply the appropriate update for Power Monitoring Expert as described above.

Summary: EcoStruxure™ Power Monitoring Expert Software & EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) - SEVD-2025-224-02 PDF Version

Summary: EcoStruxure™ Power Monitoring Expert Software & EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) - SEVD-2025-224-02 CSAF Version

Summary: Original Release

Summary: Remediations are now available for all impacting CVEs listed below for EcoStruxure™ Power Monitoring Expert (PME) 2023 & 2024 & 2024R2 and EcoStruxure™ Power Operation (EPO) 2022 & 2024 w/ Advanced Reporting and Dashboards Module. After further investigation, CVE-2025-54923 and CVE-2025-54925 do not impact EcoStruxure™ Power Monitoring Expert (PME) 2023 and prior.

Summary: Updated Affected Products and Version section to include PME 2023 R2. Updated the impacting CVEs for PME 2022, 2023, and 2023 R2. There have been remediation updates made for PME 2023, and 2023 R2.

Schneider Electric

EcoStruxure™ Power Monitoring Expert (PME) Version 2022

2023 R2 Hotfix_199767

EcoStruxure™ Power Monitoring Expert (PME) 2023 R2 Hotfix_199767

2023 R2 Hotfix_273686_release.12.0

EcoStruxure™ Power Monitoring Expert (PME) 2023 R2 Hotfix_273686_release.12.0

2024 R2

EcoStruxure™ Power Monitoring Expert (PME) Hotfix_279338_Release_2024R2

EcoStruxure™ Power Operation (EPO)

EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Version 2022

EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Version 2024

EcoStruxure™ Power Operation (EPO) 2024 w/ Advanced Reporting and Dashboards Module installed with EcoStruxure™ Power Monitoring Expert (PME) Version 2024 R2

EcoStruxure™ Power Operation (EPO) 2022 w/ Advanced Reporting and Dashboards Module installed with EcoStruxure™ Power Monitoring Expert (PME) Version 2024 R2

EcoStruxure™ Power Operation (EPO) 2022 w/ Advanced Reporting and Dashboards Module installed with EcoStruxure™ Power Monitoring Expert (PME) Version 2023 R2

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and
compromise of system integrity when authenticated users send crafted data to a network-exposed service that
performs unsafe deserialization.

CVE Description

Hotfix_279338_Release_2024R2 is available for EcoStruxure™ Power Monitoring Expert (PME) 2024 R2 that includes a fix for the vulnerabilities CVE-2025-54924, CVE-2025-54925, CVE-2025-54926, CVE-2025-54927 and CVE-2025-54923. Contact Schneider Electric’s Customer Care Center for assistance applying this hotfix. In addition to applying the hotfixes noted above, you are encouraged to review the mitigations listed below.

Customers should upgrade to the latest product offering EcoStruxure™ Power Monitoring Expert (PME) 2024 R2 and apply Hotfix_279338_Release_2024R2 that includes a fix for the vulnerabilities CVE-2025-54924, CVE-2025-54925, CVE-2025-54926, CVE-2025-54927 and CVE-2025-54923. Contact Schneider Electric’s Customer Care Center for assistance with obtaining EcoStruxure™ Power Monitoring Expert (PME) 2024 R2 and help applying this hotfix. In addition to applying the hotfix noted above, you are encouraged to review the mitigations listed below.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Ensure your deployment of PME has followed the cybersecurity hardening guidelines provided with the product. https://product-help.schneider-electric.com/EcoStruxure/Power-Monitoring-Expert-2024/content/2_planning/cybersecurity/cyber-planningrecactions.htm Ensure PME is running in an isolated network. Deploy and configure the Windows firewall to limit access to appropriate network segments. Enforce complex password policies. Review Server Access Permissions: Conduct an audit of all Windows-authenticated users who currently have access to PME.  Repeat this audit of your system periodically. Identify all accounts with access rights, especially those with elevated privileges or remote access. Limit access to essential users. Revoke access for any user accounts that are not critical for system functionality or day-to-day operations. Apply the principle of least privilege to ensure users have only the access needed for their role

Hotfix_279338_Release_2024R2 is available for EcoStruxure™ Power Monitoring Expert (PME) 2024 R2 that includes a fix for the vulnerabilities CVE-2025-54924, CVE-2025-54925, CVE-2025-54926, CVE-2025-54927 and CVE-2025-54923. Contact Schneider Electric’s Customer Care Center to determine if you are running EcoStruxure™ Power Monitoring Expert (PME) 2024 OR EcoStruxure™ Power Monitoring Expert (PME) 2024 R2 as part of your solution. Customers running either of these versions of PME can work with Schneider Electric’s Customer Care Center for assistance to upgrade PME and/or apply the hotfix. Note: Customers who are running EcoStruxure™ Power Monitoring Expert (PME) 2024 should upgrade to EcoStruxure™ Power Monitoring Expert (PME) 2024 R2 then apply the hotfix.

CVE-2025-54923

CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to
sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint.

CVE Description

Customers should upgrade to EcoStruxure™ Power Monitoring Expert (PME) 2023 R2 and apply Hotfix_199767_release and Hotfix_273686_release.12.0 that includes a fix for the vulnerabilities CVE-2025-54924, CVE-2025-54925, and CVE-2025-54927. Contact Schneider Electric’s Customer Care Center for assistance applying these hotfixes. In addition to applying the hotfixes noted above, you are encouraged to review the mitigations listed below.

Hotfix_199767_release and Hotfix_273686_release.12.0 are available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for the vulnerabilities CVE-2025-54924, CVE-2025-54925, and CVE-2025-54927. Contact Schneider Electric’s Customer Care Center for assistance applying these hotfixes. In addition to applying the hotfixes noted above, you are encouraged to review the mitigations listed below.

Hotfix_199767 and Hotfix_273686_release.12.0 is available for EcoStruxure™ Power Monitoring Expert (PME) 2023R2 that includes a fix for the vulnerabilities CVE-2025-54924, CVE-2025-54925, and CVE-2025-54927. Contact Schneider Electric’s Customer Care Center to determine if you are running EcoStruxure™ Power Monitoring Expert (PME) 2023R2 as part of your solution. Customers running this version of PME can work with Schneider Electric’s Customer Care Center for assistance applying this hotfix. OR Contact Schneider Electric’s Customer Care Center to determine if you are running EcoStruxure™ Power Monitoring Expert (PME) 2023 as part of your solution. Customers running this version of PME can work with Schneider Electric’s Customer Care Center for assistance upgrading to EcoStruxure™ Power Monitoring Expert (PME) 2023 R2 and then help applying the hotfix.

EcoStruxure™ Power Monitoring Expert (PME) 2022 version has reached its end of life and is no longer supported. Customers should immediately apply the following mitigations to reduce the risk of exploit for CVE-2025-54924, CVE-2025-54925, and CVE-2025-54927:• Ensure your deployment of PME has followed the cybersecurity hardening guidelines provided with the product. https://product-help.schneider-electric.com/EcoStruxure/Power-Monitoring-Expert-2024/content/2_planning/cybersecurity/cyber-planningrecactions.htm • Ensure PME is running in an isolated network • Deploy and configure the Windows firewall to limit access to appropriate network segments. • Enforce complex password policies. • Review Server Access Permissions • Conduct an audit of all Windows-authenticated users who currently have access to PME. Repeat this audit of your system periodically. • Identify all accounts with access rights, especially those with elevated privileges or remote access. • Limit access to essential users only. • Revoke access for any user accounts that are not critical for system functionality or daily operations. • Apply the principle of least privilege to ensure users have only the access necessary for their role(s). Customers should also consider upgrading to the latest product offering EcoStruxure™ Power Monitoring Expert (PME) 2024 R2 to resolve this issue.

CVE-2025-54924

CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to
sensitive data when an attacker configures the application to access a malicious url.

CVE Description

CVE-2025-54925

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that
could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious
file over HTTP which then gets executed.

CVE Description

CVE-2025-54926

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that
could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input
that is processed by the system.

CVE Description

CVE-2025-54927