Skip to content
OpenAdvisories
Critical ICSA-25-077-03 1 CVE

Schneider Electric EcoStruxure Power Automation System

Published Mar 11, 2025 · Updated Mar 11, 2025

Vendor: Schneider Electric Product: EcoStruxure Microgrid Operation Large (EMO-L) Product: EPAS User Interface Product: WebHMI Product: WebHMI_Fix_users_for_Standard

Summary

Schneider Electric is aware of a vulnerability in its WebHMI component used in EcoStruxure Power Automation System User Interface product and EcoStruxure Microgrid Operation Large (EMO-L) solution. EcoStruxure Power Automation System User Interface https://www.se.com/ng/en/product-range/61456-ecostruxure-power-automation-system-user-interface/#overview (formerly known as EcoSUI) is a local SCADA/HMI, based on IEC 61850, that helps operators supervise, monitor, and control large and open electrical networks, with embedded cybersecurity. Formerly EcoStruxure Substation Operation User Interface. EcoStruxure Microgrid Operation Large (EMO-L) https://www.se.com/ca/en/product-range/65897-ecostruxure-microgrid-operation/#overview is a power management system dedicated to large and critical Microgrid application. EMO-L is based on EcoStruxure Power Automation System solution (EPAS) with dedicated HMI which allows the monitoring and control of the distributed energy resources systems within the Microgrid. One HMI option for EMO-L is EcoSUI (WebHMI). Failure to apply the remediations provided below may risk unauthorized access to the underlying software application running WebHMI.

Vulnerabilities 1

Revision history

  1. #1.0.0

    Original Release

References