Description
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure™ Power Monitoring Expert (PME) | Version 2022, Version 2023, Version 2024, Version 2024 R2 | — |
| Schneider Electric | EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module | Version 2022 w/ Advanced Reporting Module, Version 2024 w/ Advanced Reporting Module | — |
Advisories 2
- ICSA-25-224-03 Schneider Electric EcoStruxure Power Monitoring Expert CISA ICS & IT advisories · Nov 11, 2025
- SEVD-2025-224-02 EcoStruxure™ Power Monitoring Expert Software & EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) Schneider Electric CPCERT · Nov 11, 2025