Description
CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable service binaries are modified in the installation folder by a local user with normal privilege upon service restart.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure™ Process Expert | Versions prior to 2025 | — |
| Schneider Electric | EcoStruxure™ Process Expert for AVEVA System Platform | All versions | — |
Advisories 2
- ICSA-26-022-01 Schneider Electric EcoStruxure Process Expert (Update A) CISA ICS & IT advisories · May 21, 2026
- SEVD-2026-013-02 Incorrect Default Permissions Vulnerability on EcoStruxure™ Process Expert Schneider Electric CPCERT · May 12, 2026