Description
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure™ Power Monitoring Expert (PME) | Version 2022, Version 2023, Version 2024, Version 2024 R2 | — |
| Schneider Electric | EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module | Version 2022 w/ Advanced Reporting Module, Version 2024 w/ Advanced Reporting Module | — |
Advisories 2
- ICSA-25-224-03 Schneider Electric EcoStruxure Power Monitoring Expert CISA ICS & IT advisories · Nov 11, 2025
- SEVD-2025-224-02 EcoStruxure™ Power Monitoring Expert Software & EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) Schneider Electric CPCERT · Nov 11, 2025