Summary
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Automation Expert product. The EcoStruxure™ Automation Expert product is plant automation software designed for digital control systems in discrete, hybrid and continuous industrial processes. A totally integrated automation solution designed to enhance your flexibility, efficiency and scalability. Failure to apply the remediation provided below may risk execution of arbitrary commands on the engineering workstation, which could result in a potential compromise of full system.
The following versions of Schneider Electric EcoStruxure Automation Expert are affected:
- EcoStruxure™ Automation Expert vers:intdot/<25.0.1, 25.0.1
| CVSS | Vendor | Equipment | Vulnerabilities |
|---|---|---|---|
| v3 8.2 | Schneider Electric | Schneider Electric EcoStruxure Automation Expert | Improper Control of Generation of Code (‘Code Injection’) |
Background
- Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing, Energy
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: France
Vulnerabilities
CVE-2026-2273
CWE-94: Improper Control of Generation of Code (‘Code Injection’) vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of the subsequent system when an authenticated user opens a malicious project file.
Affected Products
Schneider Electric EcoStruxure Automation Expert
Schneider Electric
EcoStruxure™ Automation Expert Versions prior to v25.0.1
fixed, known_affected
Remediations
Vendor fix
Version v25.0.1 of EcoStruxure™ Automation Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/23643079-ecostruxure-automation-expert/
https://www.se.com/ww/en/product-range/23643079-ecostruxure-automation-expert/
Mitigation
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Solution and archive files must be stored within the user’s home directory or in any location protected by appropriate Windows file‑system access controls to prevent unauthorized access in multi‑user environments. Users who choose to store files outside their home directory are responsible for applying restrictive Windows permissions to secure those locations. Before opening any solution or archive file, users are required to verify its authenticity and ensure that it has not been modified by unauthorized users. For detailed mitigation steps, refer to the User Manual – https://product-help.se.com/EcoStruxure%20Automation%20Expert/25.0/Offer%20Guides/en-US/EAE_UM?t=EAE_UM%2FSolutionIntegrity-FE037ED3.html%3Frhhlterm%3Dundefined%253Frhsearch%253Dundefined&theme=Help
https://product-help.se.com/EcoStruxure%20Automation%20Expert/25.0/Offer%20Guides/en-US/EAE_UM?t=EAE_UM%2FSolutionIntegrity-FE037ED3.html%3Frhhlterm%3Dundefined%253Frhsearch%253Dundefined&theme=Help
Relevant CWE: CWE-94 Improper Control of Generation of Code (‘Code Injection’)
Metrics
| CVSS Version | Base Score | Base Severity[…] Content was cut in order to protect the source.Please visit the source for the rest of the article. This article has been indexed from All CISA Advisories
Read the original article: |
|---|