Summary
Schneider Electric is aware of a vulnerability in EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation.
[EcoStruxure Building Operation (EBO)](https://www.se.com/ww/en/product-range/62111-ecostruxure-building-operation-software/#overview) is an open and scalable software platform providing insight, control and management of multiple building systems and devices in one mobile-enabled convenient view. It delivers valuable data for decision-making to improve energy management and increase efficiency for better building performance and comfort, reduced carbon, and more sustainable building environments. Failure to apply the remediations below may risk exposure of local files or denial of service, which could result in data breaches, and operational disruptions.
Vulnerabilities 2
-
High 7.0
CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintend…
-
High 7.0
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized discl…
Revision history
-
#2
Initial CISA Republication of Schneider Electric SEVD-2026-041-02 advisory
-
#1
Original Release
References
-
Multiple Vulnerabilities on EcoStruxure Building Operation Workstation and EcoStruxure Building Operation Webstation - SEVD-2026-041-02 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-041-02.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-26-055-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-02
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b