Description
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure™ Power Monitoring Expert (PME) | Version 2022, Version 2023, Version 2023 R2, Version 2024, Version 2024 R2 | — |
| Schneider Electric | EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module | Version 2022, Version 2024 | — |
Advisories 2
- ICSA-26-078-04 Schneider Electric EcoStruxure PME and EPO CISA ICS & IT advisories · Mar 19, 2026
- SEVD-2026-069-06 Deserialization of Untrusted Data vulnerability on Multiple Products Schneider Electric CPCERT · Mar 10, 2026