IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2025-070-02 — EPAS-UI & EcoSUI

MEDIUM
CVSS 6.8
Date 2026-10-16T20:32:27+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 11-Mar-25 Document Reference Number – SEVD-2025-070-02 Page 1 of 4 ## EPAS-UI & EcoSUI 11 March 2025 ## Overview Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Automation System User Interface (EPAS-UI) product. The EcoStruxure Power Automation System User Interface (EPAS-UI) product is an HMI SCADA designed for electrical networks and substations operations. Failure to apply the fix provided below may risk an Authentication Bypass attack, which could result in an attacker taking partial to full control of EPAS-UI. ## Affected Products and Versions Product Version EcoStruxure™ Power Automation System User Interface (EPAS-UI) - Secured Versions v2.1 up to and including v2.9 ## Vulnerability Details CVE ID: CVE-2025-0813 CVSS v3.1 Base Score 6.8 | Medium | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score 7.0 | High | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to reboot the workstation and interrupt the normal boot process. The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0). CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment. Schneider Electric Security Notification

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2025-0813 6.8 medium
The Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI) is vulnerable to authentication bypass. This occurs when an unauthorized user, without permission rights, has physical access to the EPAS-UI computer and is able to reboot the workstation and interrupt the normal boot process.

// Affected Products (1)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI) engineering_workstation
L3
--

// Remediations (15)

Mitigation: Never allow mobile devices that have connected to any other network besides the intended network to
Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
Mitigation: If users choose not to apply the remediation provided above, they should immediately apply the follo
If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Please strictly follow all the instructions below: Step 1: Login with Admin privileges Step 2: Go to the folder C:\MCIS\Bin Step 3: Rename the file ‘MCIS.chm' to ‘MCIS.old' Note: to see file extensions, activate the visualization of file name extensions in Windows Explorer ‘View' options. Step 4: Restart the machine.
Mitigation: Version 2.10 of EcoStruxure Power Automation System User Interface(EPAS-UI) includes a fix for this
Version 2.10 of EcoStruxure Power Automation System User Interface(EPAS-UI) includes a fix for this vulnerability and is available by contacting Schneider Electric's Customer Care Center.
Mitigation: Never connect programming software to any network other than the network intended for that device.
Never connect programming software to any network other than the network intended for that device.
Mitigation: Place all controllers in locked cabinets and never leave them in the "Program" mode.
Place all controllers in locked cabinets and never leave them in the "Program" mode.
Mitigation: Locate control and safety system networks and remote devices behind firewalls and isolate them from
Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Mitigation: For more information see the associated Schneider Electric CPCERT security advisory EPAS-UI & EcoSUI
For more information see the associated Schneider Electric CPCERT security advisory EPAS-UI & EcoSUI - SEVD-2025-070-02 PDF Version, EPAS-UI & EcoSUI - SEVD-2025-070-02 CSAF Version.
Mitigation: Schneider Electric strongly recommends the following industry cybersecurity best practices:
Schneider Electric strongly recommends the following industry cybersecurity best practices:
Mitigation: For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices docume
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
Mitigation: For more information see the associated Schneider Electric CPCERT security advisory EPAS-UI & EcoSUI
For more information see the associated Schneider Electric CPCERT security advisory EPAS-UI & EcoSUI - SEVD-2025-070-02 PDF Version, EPAS-UI & EcoSUI - SEVD-2025-070-02 CSAF Version.
Mitigation: Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. bef
Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
Mitigation: Install physical controls so no unauthorized personnel can access your industrial control and safety
Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
Mitigation: Minimize network exposure for all control system devices and systems and ensure that they are not ac
Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
Mitigation: Schneider Electric has identified the following specific remediations and workarounds users can appl
Schneider Electric has identified the following specific remediations and workarounds users can apply to reduce risk:
Mitigation: When remote access is required, use secure methods, such as virtual private networks (VPNs). Recogni
When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

// References