Summary
Schneider Electric is aware of a vulnerability in EcoStruxureTM Machine Expert - HVAC (formerly SoMachine - HVAC).
The EcoStruxureTM Machine Expert - HVAC is a commissioning software for programmable logic controllers M171/M172. The EcoStruxureTM Machine Expert - HVAC is a commissioning software for programmable logic controllers M171/M172.
Failure to apply the mitigations provided below may lead to sensitive information leakage that can potentially be used to execute arbitrary code.
Vulnerabilities 1
-
Medium 4.3
A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a mal…
Revision history
-
#1
Original Release
References
-
EcoStruxureTM Machine Expert – HVAC (formerly SoMachine - HVAC) - SEVD-2023-010-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-01_EcoStruxure_Machine_Expert_Machine_HVAC_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/