Summary
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert product (PME).
EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power-critical and energy-intensive facilities maximize uptime and operational efficiency.
Failure to apply the mitigation provided below may risk a session expiration vulnerability, which would allow an attacker unauthorized access over a hijacked session.
Vulnerabilities 1
-
Medium 6.7
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized a…
Revision history
-
#3.0.0
EcoStruxure™ Power Operation has been added to the Affected Products table.
-
#2.0.0
There is a remediation available for EcoStruxure™ Power Monitoring Expert 2021
-
#1.0.0
Original Release
References
-
EcoStruxure™ Power Monitoring Expert - SEVD-2023-073-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/