Summary
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert
(PME) and EcoStruxure™ Power Operation (EPO) products.
EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power.
critical and energy-intensive facilities maximize uptime and operational efficiency.
EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) are
on-premises software offers that provides a single platform to monitor and control medium and
lower power systems.
Failure to apply the remediations provided below could result in execution of malicious web
code, or unintended software operation.
Vulnerabilities 1
-
Medium 5.4
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when …
Revision history
-
#1.0.0
Original Release
References
-
EcoStruxure™ Power Monitoring Expert and EcoStruxure™ Power Operation or EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards - SEVD-2024-254-02 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-254-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2024-254-02.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-25-014-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-014-03
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B