Source
Schneider Electric CPCERT
Source: https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp
293 results · Feed
-
High max 8.6SEVD-2026-286-02 1 CVE
SAGE RTU
Schneider Electric is aware of a vulnerability in its SAGE RTU products. The SAGE RTU products are a line of devices designed for substation data acquisition and control. Failure to apply the mitigations provided below may enable a privileged user to install …
-
HighSEVD-2026-286-01 0 CVEs
Use of Unmaintained Third-Party Components vulnerability on Pro-face STW6000 and Harmony STW6
Schneider Electric is aware of multiple vulnerabilities in its Pro-face STW6000 and Harmony STW6 products. The Pro-face STW6000 and Harmony STW6 products are Basic Web HMI panels belongs to the Schneider Electric Harmony ST6 and Pro-face ST6000 range and is d…
-
Medium max 5.3
Multiple Altivar Process Drives and Communication Modules
Schneider Electric is aware of a vulnerability in its [ATVdPAC module](http://www.se.com/ww/en/product/VW3A3530D/atv-dpac-module/) / [ATV6000 Medium Voltage Altivar Process Drives](http://www.se.com/ww/en/product-range/65607-altivar-process-atv6000) / [ATV630…
first Sep 9, 2025 -
Medium max 5.9SEVD-2026-251-03 1 CVE
Insufficiently Protected Credentials vulnerability on SCADAPack x70 Products
Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring …
-
Critical max 9.2SEVD-2026-251-04 1 CVE
Incorrect Implementation of Authentication Algorithm vulnerability on Modicon M580 and Modicon M580 Safety
Schneider Electric is aware of a vulnerability in its Modicon M580 and Modicon M580 Safety controllers. The Modicon M580 is an Ethernet-based Programmable Automation Controller (ePAC) designed for industrial digital transformation. Failure to apply the remedi…
-
High max 8.7SEVD-2026-251-02 1 CVE
Improper Neutralization of Special Elements used in an OS Command vulnerability on PowerLogic T300
Schneider Electric is aware of a vulnerability in the Head Unit (HU250) for the PowerLogic T300 RTU (Remote Terminal Unit) (formerly Easergy T300 RTU). The [PowerLogic T300 RTU](https://www.se.com/ww/en/product-range/62399-easergy-t300) is a modular platform …
-
High max 8.6SEVD-2026-251-01 2 CVEs
Multiple Vulnerabilities on EcoStruxure IT Data Center Expert
Schneider Electric is aware of its vulnerability in its EcoStruxure IT Data Center Expert product The EcoStruxure IT Data Center Expert product is a scalable monitoring software that collects, organizes,and distributes critical device information providing a …
-
High max 7.5
Modicon Controllers M340 / Momentum / MC80 & EcoStruxure™ Control Expert
Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M340 / Momentum / MC80 / EcoStruxure™ Control Expert products. [Modicon PAC](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/?filter=b…
first Nov 12, 2024 -
High max 8.1
EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon M340, M580 and M580 Safety PLCs
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert and Modicon M340, M580 PLCs (Programmable Logic Controllers). Modicon PLCs control and monitor industrial operations. EcoStruxure™ Control…
first Feb 13, 2024 -
High max 8.1
EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon M340, M580 and M580 CPU Safety
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert, Modicon M340, Momentum, MC80, M580 and M580 CPU Safety. The Modicon M580 are PAC and Safety PLCs with built-in Ethernet for process, high availability & safety solutio…
first Jan 10, 2023 -
Critical max 7.5
Multiple Vulnerabilities in Modicon Controller Products
Schneider Electric is aware of multiple vulnerabilities in its Modicon Controller products. The [Modicon Programmable Automation controllers](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/) are used for complex netw…
first May 14, 2019 -
High max 8.7
Insufficient Entropy vulnerability on Multiple Products
Schneider Electric is aware of a vulnerability in the following products: The Easergy C5 is a scalable and interoperable bay controller, protection and merging unit for large and critical infrastructure electrical distribution systems. The Easergy MiCOM P30 i…
first May 12, 2026 -
Medium max 6.9SEVD-2026-223-01 1 CVE
Improper Restriction of Excessive Authentication Attempts vulnerability on PowerChute Serial Shutdown
Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and works…
-
Medium max 7.3SEVD-2026-223-02 2 CVEs
Multiple Vulnerabilities on NetBotz 5 750/755 Products
Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring ca…
-
High max 7.5
Modicon M340 Controller and Communication Modules
Schneider Electric is aware of a vulnerability in its Modicon M340 https://www.se.com/ww/en/product-range/1468-modicon-m340-pac/, BMXNOR0200H https://www.se.com/us/en/product/BMXNOR0200H/communication-module-modicon-m340-iec-608705101-104-dnp3-for-severe-envi…
first Aug 12, 2025 -
High max 8.7SEVD-2026-195-02 1 CVE
Insufficiently Protected Credentials vulnerability on EcoStruxure™ Cybersecurity Admin Expert
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Cybersecurity Admin Expert product (CAE). The [EcoStruxure™ Cybersecurity Admin Expert](https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=63515) product is a c…
-
High max 8.4SEVD-2026-195-01 1 CVE
Out-of-Bounds Write vulnerability in IGSS
Schneider Electric is aware of a vulnerability in its IGSS Definition module for the IGSS (Interactive Graphical SCADA System) product. The [IGSS](https://igss.schneider-electric.com/) product is a state-of-the-art SCADA system used for monitoring and control…
-
High max 7.8
RemoteConnect and SCADAPack™ x70 Utilities
Schneider Electric is aware of a vulnerability in its RemoteConnect and SCADAPack™ x70 Utilities software product. The RemoteConnect and SCADAPack™ x70 Utilities https://www.se.com/ww/en/product-category/6000-telemetry-and-remote-scada-systems/ product is a c…
first Jan 14, 2025 -
High max 8.7SEVD-2026-160-02 2 CVEs
Multiple Vulnerabilities on EasyLogic T150 and Saitel DP RTU
Schneider Electric is aware of a vulnerability in its EasyLogic T150 (formerly known as Saitel DR) and Saitel DP Remote Terminal Unit & Controller products. The [EasyLogic T150 (formerly known as Saitel DR RTU)](https://www.se.com/ww/en/product-country-select…
-
Medium max 7.1SEVD-2026-160-01 1 CVE
Improper Restriction of XML External Entity Reference vulnerability on the EcoStruxure™ IT Data Center Expert
Schneider Electric is aware of a vulnerability in its EcoStruxure™ IT Data Center Expert. The EcoStruxure™ IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a compre…
-
High max 8.7SEVD-2026-160-03 3 CVEs
Multiple Vulnerabilities on PowerLogic™ P7
Schneider Electric is aware of a vulnerability in its PowerLogic™ P7 product. The PowerLogic™ P7 is a protection and control platform designed for complex and advanced electrical network applications. Failure to apply the remediation provided below may risk u…
-
Medium max 6.8SEVD-2026-132-01 1 CVE
Clear Text Storage of Sensitive Information vulnerability on EcoStruxure™ Machine Expert HVAC
Schneider Electric is aware of a vulnerability in its EcostruxureTM Machine Expert HVAC product. The [EcostruxureTM Machine Expert HVAC](https://www.se.com/ww/en/download/document/EcoStruxureME_HVAC/) product is a programming software for Modicon M171-M172 lo…
-
Medium max 6.9
Use of Hard-coded Credentials vulnerability on Easergy MiCOM Px40 Series
Schneider Electric is aware of a vulnerability in its Easergy MiCOM Px40 Series products. The [Easergy MiCOM Px40](https://www.se.com/ww/en/product-subcategory/4725-easergy-micom-px40-series/?filter=business-6-medium-voltage-distribution-and-grid-automation) …
first Apr 14, 2026 -
High max 7.1SEVD-2026-132-03 1 CVE
Improper Limitation of a Pathname to a Restricted Directory vulnerability on Remote Terminal Unit and Controller Products
Schneider Electric is aware of a vulnerability in its EasyLogic T150 (formerly known as Saitel DR) and Saitel DP Remote Terminal Unit & Controller products. The [EasyLogic T150 (formerly known as Saitel DR RTU)](https://www.se.com/ww/en/product-country-select…
-
High max 8.2SEVD-2026-132-04 1 CVE
Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure Panel Server
Schneider Electric is aware of its vulnerability in its EcoStruxure Panel Server offer. The EcoStruxure Panel Server is a high performance, modular gateway with enhanced cybersecurity that provides easy and fast connections to multiple concurrent edge control…
-
High max 7.0
Incorrect Default Permissions Vulnerability on EcoStruxure™ Process Expert
Schneider Electric is aware of a vulnerability in its EcoStruxureTM Process and EcoStruxure™ Process Expert for AVEVA System Platform products. The EcoStruxureTM Process is a single automation system to engineer, operate, and maintain your entire infrastructu…
first Jan 13, 2026 -
Medium max 5.5
Improper Input Validation Vulnerability in Uni-Telway Driver
Schneider Electric is aware of a vulnerability in its [Uni-Telway driver](https://www.se.com/us/en/product-range/573-unitelway/#overview) which is part of [EcoStruxure™ Control Expert](https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unit…
first Feb 11, 2025 -
High max 7.8
EcoStruxure™ Process Expert, EcoStruxure™ Process Expert for AVEVA System Platform
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Process Expert, EcoStruxure™ Process Expert for AVEVA System Platform products. The EcoStruxure™ Process Expert, EcoStruxure™ Process Expert for AVEVA System Platform products are engineering …
first Feb 11, 2025 -
High max 8.5
FlexNet Publisher Vulnerability
Schneider Electric is aware of a vulnerability disclosed on Revenera FlexNet Publisher component. Many vendors, including Schneider Electric, embed Revenera FlexNet Publisher in their offers. Failure to apply the remediation/mitigations provided below may ris…
first Jan 14, 2025 -
Medium max 6.9SEVD-2026-104-01 7 CVEs
Multiple Vulnerabilities on PowerChute™ Serial Shutdown
Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The [PowerChute Serial Shutdown](https://www.se.com/ww/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling gr…
-
Critical max 9.0SEVD-2026-104-02 1 CVE
Third-Party vulnerability on Modicon Networking Managed Switches
Schneider Electric is aware of a RADIUS protocol vulnerability affecting its Modicon Network Managed Switch product. The Modicon Network Managed Switch product provides connectivity for multiple Ethernet devices, network management, enhanced cyber security an…
-
High max 8.6
Web Server on Modicon M340, Modbus/TCP Ethernet Modicon M340 module, Modbus/TCP Ethernet Modicon M340 FactoryCast module and Ethernet / Serial RTU communication modules
Schneider Electric is aware of a vulnerability in its Web Server on Modicon M340 and BMXNOE0100/0110, BMXNOR0200H communication modules products. The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network communication mod…
first Jan 14, 2025 -
Medium max 6.5
Modicon M340, Modbus/TCP Ethernet Modicon M340 module, and Modbus/TCP Ethernet Modicon M340 FactoryCast module
Schneider Electric is aware of a vulnerability in its Modicon M340 and BMXNOE0100 and BMXNOE0110 products. The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network modules used with Modicon M340. Failure to apply the mit…
first Jun 11, 2024 -
Medium max 6.9
Improper Resource Shutdown or Release vulnerability in Multiple Products
Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, and M262 products. The Modicon Controllers M241 / M251 / M262 are Programmable Logic Controllers for performancedemanding applications. Failure to apply the remediation pr…
first Mar 10, 2026 -
Medium max 5.1
Improper Neutralization vulnerability in Multiple Products
Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, M258, and LMC058 products. The [Modicon Controllers M241 / M251 / M258](https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/) and [Modicon LMC0…
first Mar 10, 2026 -
Medium max 7.0
Deserialization of Untrusted Data vulnerability on EcoStruxure™ Foxboro DCS
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Foxboro DCS Control Software on Foxboro DCS workstations and servers. Control Core Services and all runtime software, like FCPs, FDCs, and FBMs, are not affected. The [EcoStruxure™ Foxboro DCS…
first Mar 10, 2026 -
High max 7.2SEVD-2026-069-04 1 CVE
Improper Control of Generation of Code ('Code Injection') vulnerability on EcoStruxure™ Automation Expert
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Automation Expert product. The EcoStruxure™ Automation Expert product is plant automation software designed for digital control systems in discrete, hybrid and continuous industrial processes.…
-
High max 7.5SEVD-2026-069-05 1 CVE
Use of Hard-coded Credentials vulnerability in EcoStruxure™ IT Data Center Expert
Schneider Electric is aware of a hard-coded credentials vulnerability in its EcoStruxure™ IT Data Center Expert (DCE) product that requires administrator credentials and enabling a feature (SOCKS Proxy) that is off by default. The EcoStruxure™ IT Data Center …
-
Critical max 10.0
Multiple Third-Party Vulnerabilities on ProLeiT Plant iT/Brewmaxx
Schneider Electric is aware of multiple vulnerabilities in Redis open-source database, affecting its Plant iT product. The [Plant iT/Brewmaxx](https://www.proleit.com/plant-it/) product is an object-oriented and PLC-based process control system with integrate…
first Jan 13, 2026 -
High max 8.4
Multiple Vulnerabilities on EcoStruxure Power Build Rapsody
Schneider Electric is aware of a vulnerability in its EcoStruxure Power Build Rapsody software. The [EcoStruxure Power Build Rapsody](https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=2309) is used to enter or import the singl…
first Jan 13, 2026