Summary
Schneider Electric is aware of multiple vulnerabilities in EcoStruxure™ Building Operation Enterprise Server,
EcoStruxure™ Building Operation Enterprise Central, and EcoStruxure™ Workstation.
[EcoStruxure™ Building Operation (EBO)](https://www.se.com/us/en/product-range/62111-ecostruxure-building-operation-software/#overview) is an open and scalable software platform providing insight, control
and management of multiple building systems and devices in one mobile-enabled convenient view. It delivers
valuable data for decision-making to improve energy management and increase efficiency for better building
performance and comfort, reduced carbon, and more sustainable building environments.
Failure to apply the remediations below may risk credential theft and subsequent unauthorized access and
remote code execution from within the BMS network, which could result in data breaches, and operational disruptions.
September 2025 Update: Updated affected and fixed version details.
Vulnerabilities 2
-
Medium 4.1
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authentica…
-
Low 1.0
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized …
Revision history
-
#2.0.0
Updated affected and fixed version details.
-
#1.0.0
Original Release
References
-
EcoStruxure™ Building Operation Enterprise Server, EcoStruxure™ Building Operation Enterprise Central, and EcoStruxure™ Workstation - SEVD-2025-224-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-04.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-25-254-08 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-08
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B