Summary
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Power Commission software.
The EcoStruxure Power Commission software is comprehensive software to provide strong function for setup, test and commission for low voltage power distribution switchboard.
Failure to apply the remediations provided below may risk remote code execution and Information Disclosure, which could result in loss of data integrity and confidentiality.
Vulnerabilities 3
-
Medium 6.5
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that coul…
-
Medium 6.5
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a func…
-
Low 3.9
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the …
Revision history
-
#1
Original Release
References
-
EcoStruxure Power Commission - SEVD-2022-165-05 PDF Version
https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/