Description
CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an
unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to
reboot the workstation and interrupt the normal boot process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure Power Automation System User Interface (EPAS-UI) - Secured Versions | v2.1 up to and including v2.9 | — |
Advisories 2
- ICSA-25-077-01 Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI) CISA ICS & IT advisories · Mar 18, 2025
- SEVD-2025-070-02 EPAS-UI & EcoSUI Schneider Electric CPCERT · Mar 11, 2025