Schneider Electric EcoStruxure
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) products. EcoStruxure™ Power Monitoring Expert (PME) https://www.se.com/us/en/product-range/65404-ecostruxure-power-monitoring-expert/#overview is an on-premises software used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. Note: There are some instances of PME being deployed in a Managed Service model. EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) https://www.se.com/us/en/product-range/65405-ecostruxure-power-operation/?parent-subcategory-id=59326966&filter=business-4-low-voltage-products-and-systems#overview are on-premises software offers that provides a single platform to monitor and control medium and lower power systems. Failure to apply the remediation provided below may risk unintended data exposure to other authenticated users on that system.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-6788US | — | — | ||
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources
to the wrong control sphere, providing other authenticated users with poten… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) with Advanced Reporting and Dashboards - SEVD-2025-189-04 CSAF Versionself
- EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) with Advanced Reporting and Dashboards - SEVD-2025-189-04 PDF Versionself
- ICS Advisory ICSA-25-203-03 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-25-203-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (4)
- MitigationEcoStruxure™ Power Monitoring Expert (PME)
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: • We recommend you remove your TGML diagrams from your multitenant managed system or onpremises system and revert to using Vista diagrams.
- MitigationEcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: • We recommend you remove your TGML diagrams from your multitenant managed system or onpremises system and revert to using Vista diagrams.
- BehobenEcoStruxure™ Power Monitoring Expert (PME)
Hotfix_199767 is available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.
- BehobenEcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module
Hotfix_199767 available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan