Summary
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert
(PME) product.
EcoStruxure™ Power Monitoring Expert (PME) https://www.se.com/us/en/product-range/65404-ecostruxure-power-monitoring-expert/#overview is an on-premises software product used to help
power critical and energy-intensive facilities maximize uptime and operational efficiency.
Failure to apply the remediation provided below may risk deserialization of untrusted data,
which could result in Remote Code Execution.
March 2025 Update: The CVSS4.0 scoring has been added to the vulnerability details and more
specific remediation information provided.
Vulnerabilities 1
-
High 7.3
CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the se…
Revision history
-
#1.1.1
Removed unreferenced product and its version from the product tree.
-
#1.1.0
The CVSS4.0 scoring has been added to the vulnerability details and more specific remediation information provided.
-
#1.0.0
Original Release
References
-
EcoStruxure™ Power Monitoring Expert (PME) - SEVD-2024-282-05 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-05.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390