Description
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure™ Power Monitoring Expert (PME) | Version 2022, Version 2023, Version 2024, Version 2024 R2 | — |
| Schneider Electric | EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module | Version 2022 w/ Advanced Reporting Module, Version 2024 w/ Advanced Reporting Module | — |
Advisories 2
- ICSA-25-224-03 Schneider Electric EcoStruxure Power Monitoring Expert CISA ICS & IT advisories · Nov 11, 2025
- SEVD-2025-224-02 EcoStruxure™ Power Monitoring Expert Software & EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) Schneider Electric CPCERT · Nov 11, 2025