Summary
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert
product.
EcoStruxure™ Control Expert is the common programming, debugging and operating software
for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation
Controllers).
Failure to apply the remediations provided below may risk arbitrary code execution & privilege
escalation which could result in denial of service, loss of confidentiality and integrity of the
software
January 2024 Update: A remediation is available for EcoStruxure™ Control Expert.
Vulnerabilities 2
-
High 8.8
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a vali…
-
Medium 5.5
A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of serv…
Revision history
-
#2.0.0
A remediation is now available for EcoStruxure™ Control Expert.
-
#1.0.0
Original Release
References
-
EcoStruxure™ Control Expert - SEVD-2023-101-03 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-03.pdf
-
Recommended Cybersecurity Best Practices
https://download.schneider-electric.com/files?p_Doc_Ref=7EN52-0390&p_enDocType=White+Paper&p_File_Name=Cybersecurity_Best+Practices_EN.pdf