Skip to content
OpenAdvisories
Critical ICSA-26-083-03 4 CVEs

"Schneider Electric Plant iT/Brewmaxx"

Published Jan 13, 2026 · Updated Mar 24, 2026 · Revision 3

Vendor: Schneider Electric Product: Plant iT/Brewmaxx

Summary

Schneider Electric is aware of multiple vulnerabilities in Redis open-source database, affecting its Plant iT product.
The [Plant iT/Brewmaxx](https://www.proleit.com/plant-it/) product is an object-oriented and PLC-based process control system with integrated
Manufacturing Execution System functionality. The integrated and modular software platform consists of basic
systems, modules and add-ons that can be flexibly combined.
Failure to apply the remediations provided below may risk privilege escalation, which could result in remote
code execution.

Vulnerabilities 4

  • Critical 10.0
    CVE-2025-49844 Public exploit Scanner template EPSS 83%

    Redis Lua Use-After-Free may lead to remote code execution

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code exe…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2025-46817 Public exploit Scanner template

    Lua library commands may lead to integer overflow and potential RCE

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all …

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2025-46819 Public exploit Scanner template

    Redis is vulnerable to DoS via specially crafted LUA scripts

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • Medium 6.0
    CVE-2025-46818 Public exploit Scanner template

    Redis: Authenticated users can execute LUA scripts as a different user

    Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine

Revision history

  1. #3

    Initial CISA Republication of Schneider Electric CPCERT SEVD-2026-013-01 advisory

  2. #2

    Updated the CWE description of CVE-2025-46819

  3. #1

    Original Release

References