Skip to content
OpenAdvisories
High ICSA-25-224-03 5 CVEs

Schneider Electric EcoStruxure Power Monitoring Expert

Published Aug 12, 2025 · Updated Nov 11, 2025 · Revision 3

Vendor: Schneider Electric Product: Advanced Reporting and Dashboards Module Product: EcoStruxure Power Operation (EPO) Product: EcoStruxure™ Power Monitoring Expert (PME)

Summary

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO) and EcoStruxure Power SCADA Operation (PSO) products. EcoStruxure Power Monitoring Expert (PME) is an on-premises software used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. Note: There are some instances of PME being deployed in a Managed Service model. EcoStruxure Power Operation (EPO) and EcoStruxure Power SCADA Operation (PSO) are on-premises software offers that provides a single platform to monitor and control medium and lower power systems. Failure to apply the remediation and/or mitigations provided below may risk deserialization of untrusted data, server-side request forgery and/or path traversal that could result in remote code execution, and/or unauthorized access to sensitive data.

Vulnerabilities 5

Revision history

  1. #3.0.0

    Updated Affected Products and Version section to include PME 2023 R2. Updated the impacting CVEs for PME 2022, 2023, and 2023 R2. There have been remediation updates made for PME 2023, and 2023 R2.

  2. #2.0.0

    Remediations are now available for all impacting CVEs listed below for EcoStruxure Power Monitoring Expert (PME) 2023 & 2024 & 2024R2 and EcoStruxure Power Operation (EPO) 2022 & 2024 w/ Advanced Reporting and Dashboards Module. After further investigation, CVE-2025-54923 and CVE-2025-54925 do not impact EcoStruxure Power Monitoring Expert (PME) 2023 and prior.

  3. #1.0.0

    Original Release

References