Skip to content
OpenAdvisories
High ICSA-25-037-02 1 CVE

Schneider Electric EcoStruxure (Update D)

Published Jan 14, 2025 · Updated Apr 2, 2026 · Revision 11

Vendor: Schneider Electric Product: EcoStruxure Architecture Builder Product: EcoStruxure Control Expert Product: EcoStruxure Machine Expert Product: EcoStruxure Operator Terminal Expert Product: EcoStruxure™ Control Expert Asset Link Product: EcoStruxure™ Machine Expert Safety Product: EcoStruxure™ Machine Expert Twin Product: EcoStruxure™ Machine SCADA Expert Asset Link Product: EcoStruxure™ OPC UA Server Expert Product: EcoStruxure™ Process Expert Product: EcoStruxure™ Process Expert 2023 Product: EcoStruxure™ Process Expert for AVEVA System Platform Product: Pro-face BLUE Product: Vijeo Designer Product: Zelio Soft 2

Summary

Schneider Electric is aware of a vulnerability disclosed on Revenera FlexNet Publisher component.
Many vendors, including Schneider Electric, embed Revenera FlexNet Publisher in their offers.
Failure to apply the remediation/mitigations provided below may risk a local privilege escalation, which could
lead to the execution of a malicious DLL with elevated privilege.

Vulnerabilities 1

  • High 8.5
    CVE-2024-2658

    Local privilege escalation in FlexNet Publisher

    A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create th…

    Flexera Software FlexNet Publisher

Revision history

  1. #11

    CISA Republication update based on Schneider Electric CPCERT SEVD-2025-014-07 advisory

  2. #10

    A remediation is now available for EcoStruxure™ Machine Expert and EcoStruxure™ Machine Expert Twin

  3. #9

    CVE, CWE, & CVSS Score information was added.

  4. #8

    CISA Republication - Update C - Remediations are now available for Zelio Soft 2 and EcoStruxure OPC UA Server Expert offers.

  5. #7

    A remediation is now available for Zelio Soft 2 and EcoStruxure™ OPC UA Server Expert offers

  6. #6

    CISA Republication - Update B - Pro-face BLUE is added to the "Affected Products" section. Remediations are now available for EcoStruxure Control Expert, EcoStruxure Operator Terminal Expert and Pro-face BLUE offers. Updated the link to the fix of EcoStruxure Control Expert Asset Link offer.

  7. #5

    Pro-face BLUE is added to the “Affected Product and Versions” section. Remediations are now available for EcoStruxure™Control Expert, EcoStruxure™ Operator Terminal Expert and Pro-face BLUE offers. Updated the link to the fix of EcoStruxure™ Control Expert Asset Link offer

  8. #4

    CISA Republication - Update A - A remediation is available for EcoStruxure Process Expert. The EcoStruxure Process Expert for AVEVA System Platform offer is added to the Affected Products.

  9. #3

    A remediation is available for the EcoStruxure™ Process Expert offer. The EcoStruxure™ Process Expert for AVEVA System Platform offer is added to the “Affected Product and Versions” section

  10. #2

    CISA Republication - Initial Publication

  11. #1

    Original Release

References