Vendor
Schneider Electric
434 known vulnerabilities.
Schneider Electric at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 1 | 0 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 9 | 1 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 3 | 1 |
| Jun 2026 | 6 | 0 |
| May 2026 | 4 | 0 |
| Apr 2026 | 8 | 0 |
| Mar 2026 | 6 | 0 |
| Feb 2026 | 2 | 0 |
| Jan 2026 | 3 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 3 | 0 |
| Aug 2025 | 10 | 0 |
| Jul 2025 | 7 | 1 |
| Jun 2025 | 10 | 0 |
| May 2025 | 2 | 0 |
| Apr 2025 | 5 | 0 |
| Mar 2025 | 3 | 1 |
| Feb 2025 | 9 | 0 |
| Jan 2025 | 9 | 0 |
| Dec 2024 | 3 | 1 |
Products
Latest advisories
-
Medium max 4.6SEVD-2026-314-01 1 CVE
Use After Free vulnerability on EcoStruxure™ Power Build Rapsody
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Build Rapsody product. The EcoStruxure™ Power Build Rapsody is used to enter or import the single line diagram, to get the extensive bill of material of your switchboard, including all d…
-
High max 8.6SEVD-2026-286-02 1 CVE
SAGE RTU
Schneider Electric is aware of a vulnerability in its SAGE RTU products. The SAGE RTU products are a line of devices designed for substation data acquisition and control. Failure to apply the mitigations provided below may enable a privileged user to install …
-
HighSEVD-2026-286-01 0 CVEs
Use of Unmaintained Third-Party Components vulnerability on Pro-face STW6000 and Harmony STW6
Schneider Electric is aware of multiple vulnerabilities in its Pro-face STW6000 and Harmony STW6 products. The Pro-face STW6000 and Harmony STW6 products are Basic Web HMI panels belongs to the Schneider Electric Harmony ST6 and Pro-face ST6000 range and is d…
-
Medium max 5.3
Multiple Altivar Process Drives and Communication Modules
Schneider Electric is aware of a vulnerability in its [ATVdPAC module](http://www.se.com/ww/en/product/VW3A3530D/atv-dpac-module/) / [ATV6000 Medium Voltage Altivar Process Drives](http://www.se.com/ww/en/product-range/65607-altivar-process-atv6000) / [ATV630…
first Sep 9, 2025 -
High max 7.5
Schneider Electric Modicon M340 Controller and Communication Modules
Schneider Electric is aware of a vulnerability in its Modicon M340 https://www.se.com/ww/en/product-range/1468-modicon-m340-pac/, BMXNOR0200H https://www.se.com/us/en/product/BMXNOR0200H/communication-module-modicon-m340-iec-608705101-104-dnp3-for-severe-envi…
first Aug 12, 2025
434 results · Feed
-
Medium 4.6
CWE- 416: Use After Free vulnerability exists that could cause arbitrary code execution when a local attacker could tri…
-
High 8.6
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be u…
-
Critical 9.2
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidenti…
-
Medium 5.9CVE-2026-81861 Public exploit
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information…
-
High 8.7
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists…
-
High 8.6
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and di…
-
High 8.6
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that co…
-
Medium 6.9
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to…
-
Medium 5.1
CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the N…
-
High 7.3
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists…
-
High 8.2
CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service o…
-
High 8.4
CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execu…
-
Critical 9.3
CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, …
-
High 8.7
CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthoriz…
-
Medium 6.9
CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-serv…
-
High 8.6
CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that coul…
-
High 8.7
CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the dev…
-
Medium 6.7
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of…
-
High 8.7
CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensiti…
-
High 7.1
CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclos…
-
Medium 6.8
Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the sou…
-
High 8.2
Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using…
-
High 7.1
Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Products
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.
-
High 8.7
Insufficient Entropy vulnerability on Multiple Products
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
-
Low 2.4
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information…
-
Medium 5.3
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application u…
-
Medium 5.3
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log tr…
-
Medium 5.3
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file crea…
-
Medium 6.9
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to …
-
Medium 6.9
CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when…
-
Medium 6.9
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could c…
-
Medium 6.9
CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device inf…
-
High 7.2
CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of unt…
-
High 7.0
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity a…
-
Medium 5.1
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that c…
-
Medium 6.9
CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machin…
-
High 8.5
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administ…
-
High 7.5
CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code exe…
-
High 7.0
CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintend…
-
High 7.0
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized discl…