Schneider Electric EcoStruxure Power Operation (Update A)

Summary

Vulnerabilities 6

• High 8.8
  CVE-2023-5217 Exploited Public exploit EPSS 49%

  Electron affected by libvpx's heap buffer overflow in vp8 encoding

  Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  Google Chrome libvpx chromium Browsers Debian Ubuntu Alpine npm
  Sep 28, 2023

  KEV Oct 2, 2023
• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 8.1
  CVE-2023-50447

  Arbitrary Code Execution in Pillow

  Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Jan 19, 2024
• High 7.5
  CVE-2022-45198

  Pillow vulnerable to Data Amplification attack.

  Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

  pillow pillow pillow pillow-python2 Debian Ubuntu PyPI
  Nov 14, 2022
• High 7.5
  CVE-2023-35945

  Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec

  Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of p…

  envoyproxy envoy nodejs cmake Azure Linux Alpine
  Jul 13, 2023
• Medium 6.7
  CVE-2024-28219

  Pillow buffer overflow vulnerability

  In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Apr 3, 2024

Revision history

1. 2026-02-25 #2

   Update A - Remediations are available for EcoStruxure Power Operation 2022

2. 2025-07-22 #1

   Initial Republication of Schneider Electric SEVD-2025-189-03

References

• ICSA Advisory ICSA-25-203-04 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
• Recommended Practices
  https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
• Recommended Practices
  https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks