Summary
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Automation Expert product.
The EcoStruxure™ Automation Expert product is plant automation software designed for digital control systems
in discrete, hybrid and continuous industrial processes. A totally integrated automation solution designed to
enhance your flexibility, efficiency and scalability.
Failure to apply the remediation provided below may risk execution of arbitrary commands on the engineering
workstation, which could result in a potential compromise of full system.
Vulnerabilities 1
-
High 7.2
CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of unt…
Revision history
-
#2
Initial CISA Republication of Schneider Electric CPCERT SEVD-2026-069-04 advisory
-
#1
Original Release
References
-
Improper Control of Generation of Code ('Code Injection') vulnerability on EcoStruxure™ Automation Expert - SEVD-2026-069-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-04.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-26-078-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-03
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b