Summary
Schneider Electric is aware of a vulnerability in its Web Designer configuration tool for the following
FactoryCast modules:
• BMXNOR0200H
• BMXNOE0110(H)
• BMENOC0311(C)
• BMENOC0321(C)
The Web Designer product is a software application used to create Web-based operator panels and configure
operating parameters for Web human machine interface (Web HMI) devices.
Failure to apply the Mitigations provided below may risk XML external entity attack, which could result in
information disclosure, workstation integrity and potential remote code execution on the compromised
computer.
Vulnerabilities 1
-
High 7.8
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclo…
Revision history
-
#1.0.0
Original Release
References
-
Web Designer for FactoryCast modules - SEVD-2025-014-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-04.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/