Description
CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be
remotely executed on the server when unsafely deserialized data is posted to the web server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure Power Monitoring Expert (PME) | Version 2022 and prior | — |
Advisories 2
- ICSA-25-037-01 Schneider Electric EcoStruxure Power Monitoring Expert (PME) (Update B) CISA ICS & IT advisories · May 13, 2025
- SEVD-2024-282-05 EcoStruxure™ Power Monitoring Expert (PME) Schneider Electric CPCERT · May 13, 2025