ICSA-25-079-01

icsaUScisa_csaf_ot

Schneider Electric EcoStruxure (Update A)

Advisory ansehen veröffentlicht 2025-02-11

Schneider Electric is aware of a vulnerability in its EcoStruxure Process Expert, EcoStruxure Process Expert for AVEVA System Platform products. The EcoStruxure Process Expert, EcoStruxure Process Expert for AVEVA System Platform products are engineering tools that facilitates and automates the design, maintenance, commissioning, and operation of Control projects for Modicon controllers and the associated Supervision projects for SCADA software regrouped in a system.. Failure to apply the Fix/Mitigations provided below may risk a local privilege escalation, which could result in loss of confidentiality, integrity and availability of the engineering workstation.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2025-0327US——
CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing client request) that co…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (6)

  • MitigationEcoStruxure Process Expert

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:• Allow execute permission for service control Windows utility only to admin user.• McAfee Application and Change Control software for application control to allow execution of whitelisted applications only. Refer to the Cybersecurity Application Note available https://www.se.com/ww/en/download/document/EIO0000004778/

    https://www.se.com/ww/en/download/document/EIO0000004778/
  • MitigationEcoStruxure Process Expert 2023

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:• Allow execute permission for service control Windows utility only to admin user.• McAfee Application and Change Control software for application control to allow execution of whitelisted applications only. Refer to the Cybersecurity Application Note available https://www.se.com/ww/en/download/document/EIO0000004778/

    https://www.se.com/ww/en/download/document/EIO0000004778/
  • MitigationEcoStruxure Process Expert for AVEVA System Platform

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Allow only admin user to configure windows service by restricting execute permission of sc.exe windows utility. • McAfee Application and Change Control software for application control to allow execution of whitelisted applications only. Refer to the Cybersecurity Application Note available https://www.se.com/ww/en/download/document/EIO0000004778/

    https://www.se.com/ww/en/download/document/EIO0000004778/
  • BehobenEcoStruxure Process Expert

    Version v4.8.0.5715 of EcoStruxure Process Expert 2023 Software Package includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/65406-ecostruxure-processexpert/#software-and-firmware. Uninstall Previous Version 2023 (v4.8.0.5115) before installing Version 2023 (v4.8.0.5715). Version string could be found on engineering server console.

    https://www.se.com/ww/en/product-range/65406-ecostruxure-process-expert/#software-and-firmware
  • BehobenEcoStruxure Process Expert 2023

    Version v4.8.0.5715 of EcoStruxure Process Expert 2023 Software Package includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/65406-ecostruxure-processexpert/#software-and-firmware. Uninstall Previous Version 2023 (v4.8.0.5115) before installing Version 2023 (v4.8.0.5715). Version string could be found on engineering server console.

    https://www.se.com/ww/en/product-range/65406-ecostruxure-process-expert/#software-and-firmware
  • BehobenEcoStruxure Process Expert for AVEVA System Platform

    Version 2025 of EcoStruxure Process Expert for AVEVA System Platform 2025 Software Package includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/55570689-ecostruxure-process-expert-for-aveva-system-platform/#software-and-firmware

    https://www.se.com/ww/en/product-range/55570689-ecostruxure-process-expert-for-aveva-system-platform/#software-and-firmware
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan