Description
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to
execute arbitrary code on the targeted system by sending a specifically crafted packet to the
application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure Power Monitoring Expert | All versions – prior to application of Hotfix-145271 | — |
| Schneider Electric | EcoStruxure Power Operation (EPO) with Advanced Reports | All versions – prior to application of Hotfix-145271 | — |
| Schneider Electric | EcoStruxure Power SCADA Operation with Advanced Reports | All versions – prior to application of Hotfix-145271 | — |
Advisories 2
- ICSA-23-290-01 Schneider Electric EcoStruxure Power Monitoring Expert and Power Operation Products CISA ICS & IT advisories · Oct 17, 2023
- SEVD-2023-283-02 EcoStruxure Power Monitoring Expert and EcoStruxure™ Power Schneider Electric CPCERT · Oct 10, 2023