Summary
Schneider Electric is aware of a vulnerability in its EcoStruxure Power Build Rapsody software. The [EcoStruxure Power Build Rapsody](https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=2309) is used to enter or import the single line diagram, to get the extensive bill of material of your switchboard, including all devices, connection items, and mounting components.
Failure to apply the mitigations/remediations provided below may risk memory corruption, heap-based buffer overflow, stack-based buffer overflow, which could result in local attackers being able to exploit these issues to potentially execute arbitrary code.
Vulnerabilities 2
-
High 8.4
CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious…
-
High 8.4
CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious pr…
Revision history
-
#4
Update A - Removed link to the fix for Rapsody Belgium version
-
#3
Removed the link to the fix for Rapsody Belgium version, which was privately communicated to impacted users
-
#2
CISA Republication - Initial Republication of Schneider Electric SEVD-2026-013-04 advisory
-
#1
Original Release
References
-
Multiple Vulnerabilities on EcoStruxure Power Build Rapsody - SEVD-2026-013-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-04.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-26-015-10 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-10
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b