Schneider Electric EcoStruxure Power Monitoring Expert (PME) (Update B)
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) product. EcoStruxure™ Power Monitoring Expert (PME) https://www.se.com/us/en/product-range/65404-ecostruxure-power-monitoring-expert/#overview is an on-premises software product used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. Failure to apply the remediation provided below may risk deserialization of untrusted data, which could result in Remote Code Execution. March 2025 Update: The CVSS4.0 scoring has been added to the vulnerability details and more specific remediation information provided.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-9005US | — | — | ||
CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be
remotely executed on the server when unsafely deserialized data is posted to the web ser… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- EcoStruxure™ Power Monitoring Expert (PME) - SEVD-2024-282-05 CSAF Versionself
- EcoStruxure™ Power Monitoring Expert (PME) - SEVD-2024-282-05 PDF Versionself
- ICS Advisory ICSA-25-037-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-25-037-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (2)
- MitigationEcoStruxure Power Monitoring Expert (PME)
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit. EcoStruxure™ Power Monitoring Expert 2021 and prior have reached end-of-life support. Customers should consider upgrading to the latest version offering of PME to resolve this issue. Please contact Schneider Electric Customer Care Center https://www.se.com/us/en/work/support/ for more details.
https://www.se.com/us/en/work/support/ - BehobenEcoStruxure Power Monitoring Expert (PME)
Hotfix_75031_PME2022 available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center https://www.se.com/us/en/work/support/ to download this hotfix.
https://www.se.com/us/en/work/support/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan