IM
IronMonkey Threat Research
‹ Back to ICS Advisories

EcoStruxure™ Power Build Rapsody

MEDIUM
CVSS 5.3
Date 2026-10-16T20:32:12+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 14-Jan-25 (13-May-25) Document Reference Number – SEVD-2025 -014-09 (v2.0.0) Page 1 of 5 ## EcoStruxure™ Power Build Rapsody 14 January 2025 (13 May 2025) ## Overview Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Build Rapsody software. The EcoStruxure™ Power Build Rapsody is used to enter or import the single line diagram, to get the extensive bill of material of your switchboard, including all devices, connection items, and mounting components Failure to apply the remediations and mitigations provided below may risk memory corruption, heap-based buffer overflow, stack-based buffer overflow, which could result in local attackers being able to exploit these issues to potentially execute arbitrary code. May 2025 Update: A remediation is available for this vulnerability in V2.8.4 INT and corrected the Affected Products and Versions table with EcoStruxure™ Power Build–Rapsody INT version. ## Affected Products and Versions Product Version EcoStruxure™ Power Build Rapsody Version v2.5.2 NL and prior Version v2.7.1 FR and prior Version v2.7.5 ES and prior Version v2.6.4 INT and prior ## Vulnerability Details CVE ID: CVE-2024-11139 CVSS v3.1 Base Score 5.3 | Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS v4.0 Base Score 4.6 | Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to exploit these issues to potentially execute arbitrary code when opening a malicious project file.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2024-11139 5.3 medium
CVE-2024-11139. CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to exploit these issues to potentially execute arbitrary code when opening a malicious project file.

// Affected Products (1)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric EcoStruxure Power Build Rapsody engineering_workstation
L3
--

// Remediations (5)

Patch: Version ES v2.7.52 of EcoStruxure Power Build Rapsody includes a fix for this vulnerability and are
Version ES v2.7.52 of EcoStruxure Power Build Rapsody includes a fix for this vulnerability and are available for download here: https://www.se.com/es/es/product-range/2309-ecostruxure-power-build-rapsody/#software-and-firmwarePlease reboot after installing the new version.
Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the f
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Only open projects from trusted sources. • Ensure use of malware scans before opening any externally created project • Encrypt project file when stored and restrict the access to only trusted users. • When exchanging files over the network, use secure communication protocols. • Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp
Patch: Version FR v2.7.12 of EcoStruxure Power Build Rapsody includes a fix for this vulnerability and are
Version FR v2.7.12 of EcoStruxure Power Build Rapsody includes a fix for this vulnerability and are available for download here: https://www.se.com/fr/fr/product-range/2309-ecostruxure-power-build-rapsody/#software-and-firmwarePlease reboot after installing the new version.
Patch: Version NL v2.7.2 of EcoStruxure Power Build Rapsody includes a fix for this vulnerability and are a
Version NL v2.7.2 of EcoStruxure Power Build Rapsody includes a fix for this vulnerability and are available for download here: https://www.se.com/nl/nl/product-range/2309-ecostruxure-power-build-rapsody/#software-and-firmware Please reboot after installing the new version.
Patch: Version v2.8.4 INT of EcoStruxure Power Build Rapsody includes a fix for this vulnerability and is a
Version v2.8.4 INT of EcoStruxure Power Build Rapsody includes a fix for this vulnerability and is available for download here:https://www.se.com/ww/en/product-range/2309-ecostruxure-power-build-rapsody/#overview Please reboot the system after installing the new version.

// References