Schneider Electric EcoStruxure
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) products. EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power. critical and energy-intensive facilities maximize uptime and operational efficiency. EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) are on-premises software offers that provides a single platform to monitor and control medium and lower power systems. Failure to apply the remediations provided below could result in execution of malicious web code, or unintended software operation.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-8401US | — | — | ||
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
vulnerability exists when an authenticated attacker modifies folder names within the co… | ||||
references
External citations — patches, advisories, analysis.
- EcoStruxure™ Power Monitoring Expert and EcoStruxure™ Power Operation or EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards - SEVD-2024-254-02 CSAF Versionself
- EcoStruxure™ Power Monitoring Expert and EcoStruxure™ Power Operation or EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards - SEVD-2024-254-02 PDF Versionself
- ICS Advisory ICSA-25-014-03 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-25-014-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (7)
- FixedEcoStruxure™ Power Monitoring Expert (PME) 2020
EcoStruxure™ Power Monitoring Expert 2020 is at its end-of-life support. Customers should consider upgrading to the latest version offering of PME to resolve this issue. Please contact Schneider Electric Customer Care Center for more details.
https://www.se.com/us/en/work/support/ - FixedEcoStruxure™ Power Monitoring Expert (PME) 2021
EcoStruxure™ Power Monitoring Expert 2021 CU2 includes a fix for this vulnerability and is available for download here: https://ecoxpert.se.com/software-center/power-monitoringexpert/ power-monitoring-expert-2021 OR EcoStruxure™ Power Monitoring Expert 2022 includes a fix for this vulnerability and is available for download here: https://ecoxpert.se.com/software-center/power-monitoringexpert/ power-monitoring-expert-2022 OR Upgrade to the latest version of EcoStruxure™ Power Monitoring Expert. Contact the customer care center for more information.
https://ecoxpert.se.com/software-center/power-monitoringexpert/ - FixedEcoStruxure™ Power Operation (EPO) 2021
EcoStruxure™ Power Operations 2021 CU3 Hotfix 3 includes a fix for this vulnerability and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2022- Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058 OR Upgrade to latest version of EcoStruxure™ Power Operations. Contact the customer care center for more information. Additionally, EcoStruxure™ Power Operation 2021 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You will need to update the version of EcoStruxure™ Power Monitoring Expert installed independently of the EcoStruxure™ Power Operation patch level installed and apply the appropriate EcoStruxure™ Power Monitoring Expert update as outlined above. For assistance in determining the version of PME installed, contact the Schneider Electric Customer Care Center.
https://community.se.com/t5/EcoStruxure-Power-Operation/v2022- - FixedEcoStruxure™ Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module
EcoStruxure™ Power Operations 2021 CU3 Hotfix 3 includes a fix for this vulnerability and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2022- Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058 OR Upgrade to latest version of EcoStruxure™ Power Operations. Contact the customer care center for more information. Additionally, EcoStruxure™ Power Operation 2021 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You will need to update the version of EcoStruxure™ Power Monitoring Expert installed independently of the EcoStruxure™ Power Operation patch level installed and apply the appropriate EcoStruxure™ Power Monitoring Expert update as outlined above. For assistance in determining the version of PME installed, contact the Schneider Electric Customer Care Center.
https://community.se.com/t5/EcoStruxure-Power-Operation/v2022- - FixedEcoStruxure™ Power Operation (EPO) 2022
EcoStruxure™ Power Operations 2022 CU5 includes a fix for this vulnerability and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2022- Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058 OR Upgrade to latest version of EcoStruxure™ Power Operations. Contact the customer care center for more information. Additionally, EcoStruxure™ Power operation 2022 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You will need to update the version of EcoStruxure™ Power Monitoring Expert installed independently of the EcoStruxure™ Power Operation patch level installed and apply the appropriate EcoStruxure™ Power Monitoring Expert update as outlined above. For assistance in determining the version of PME installed, contact the Schneider Electric Customer Care Center.
https://community.se.com/t5/EcoStruxure-Power-Operation/v2022-Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058 - FixedEcoStruxure™ Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module
EcoStruxure™ Power Operations 2022 CU5 includes a fix for this vulnerability and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2022- Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058 OR Upgrade to latest version of EcoStruxure™ Power Operations. Contact the customer care center for more information. Additionally, EcoStruxure™ Power operation 2022 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You will need to update the version of EcoStruxure™ Power Monitoring Expert installed independently of the EcoStruxure™ Power Operation patch level installed and apply the appropriate EcoStruxure™ Power Monitoring Expert update as outlined above. For assistance in determining the version of PME installed, contact the Schneider Electric Customer Care Center.
https://community.se.com/t5/EcoStruxure-Power-Operation/v2022-Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058 - FixedEcoStruxure™ Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module
EcoStruxure™ Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module is at its end-of-life support. Customers should consider upgrading to the latest version offering of EPO to resolve this issue. Please contact Schneider Electric Customer Care Center for more details.
https://www.se.com/us/en/work/support/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan