IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2024-317-04 — EcoStruxure™ IT Gateway

CRITICAL
CVSS 9.8
Date 2026-10-16T20:33:01+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 12-Nov-24 Document Reference Number – SEVD-2024-317-04 Page 1 of 4 ## EcoStruxure™ IT Gateway 12 November 2024 ## Overview Schneider Electric is aware of a vulnerability in its EcoStruxure™ IT Gateway. The EcoStruxure™ IT Gateway is a component of the EcoStruxure™ IT platform, designed to connect your IT infrastructure devices to the cloud. It collects data from these devices and securely transmits it to the EcoStruxure™ IT platform for analysis and management. Failure to apply the fix provided below may risk unauthorized access to EcoStruxure™ IT Gateway which could result in control of the Gateway and/or retrieval of sensitive information. ## Affected Products and Versions Product Version EcoStruxure™ IT Gateway Versions 1.21.0.6, 1.22.0.3, 1.22.1.5, 1.23.0.4 ## Vulnerability Details CVE ID: CVE-2024-10575 CVSS v3.1 Base Score 9.8| Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score 10.0| Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected devices. The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0). CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment. Schneider Electric Security Notification 12-Nov-24 Document Reference Number – SEVD-2024-317-04 Page 2 of 4 ## Remediation

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2024-10575 9.8 critical
CVE-2024-10575. CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected devices.

// Affected Products (1)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric EcoStruxure™ IT Gateway engineering_workstation
L3
1.21.0.6

// Remediations (2)

Patch: Version 1.23.1.10 of EcoStruxure™ IT Gateway includes a fix for this vulnerability and is availabl
Version 1.23.1.10 of EcoStruxure™ IT Gateway includes a fix for this vulnerability and is available for download here: • https://community.se.com/t5/What-s-new-inEcoStruxure-IT/Download-the-EcoStruxure-ITGateway/ta-p/455022 • Instructions provided in the link above. • We encourage customers to enable automatic updates to receive updates promptly. • Customers who have enabled automatic updates do not need to take any further action. Prior versions are not impacted by this vulnerability.
Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Customers should protect the Gateway from remote access by controlling access to the software over a network. The following actions could be taken: • Placing the Gateway software on protected access-controlled networks only • Implementing a local firewall to deny remote access to the web API. • Removing the Gateway software and installing a clean build of 1.23.1.10

// References