IM
IronMonkey Threat Research
‹ Back to ICS Advisories

WebHMI Component For EcoStruxure™ Power Automation System User Interface and EcoStruxure™ Microgrid Operation Large

CRITICAL
CVSS 9.8
Date 2026-10-16T20:32:30+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 11-Mar-25 Document Reference Number – SEVD-2025 -070-03 Page 1 of 4 ## WebHMI Component For EcoStruxure™ Power Automation System User Interface and EcoStruxure™ Microgrid Operation Large 11 March 2025 Overview Schneider Electric is aware of a vulnerability in its WebHMI component used in EcoStruxure™ Power Automation System User Interface product and EcoStruxure™ Microgrid Operation Large (EMO-L) solution. EcoStruxure™ Power Automation System User Interface (formerly known as EcoSUI) is a local SCADA/HMI, based on IEC 61850, that helps operators supervise, monitor, and control large and open electrical networks, with embedded cybersecurity. Formerly EcoStruxure Substation Operation User Interface. EcoStruxure™ Microgrid Operation Large (EMO-L) is a power management system dedicated to large and critical Microgrid application. EMO-L is based on EcoStruxure™ Power Automation System solution (EPAS) with dedicated HMI which allows the monitoring and control of the distributed energy resources systems within the Microgrid. One HMI option for EMO-L is EcoSUI (WebHMI). Failure to apply the remediations provided below may risk unauthorized access to the underlying software application running WebHMI. Affected Products and Versions Product Version WebHMI – Deployed with EcoStruxure™ Power Automation System WebHMI v4.1.0.0 and prior when deployed with EPAS User Interface 2.6.30.19 and prior Note: EMO-L is based on EcoStruxure™ Power Automation System solution (EPAS). EMO-L customers using the versions above are affected. Vulnerability Details CVE ID: CVE-2025-1960 CVSS v3.1 Base Score 9.8 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score 9.2 | Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2025-1960 9.8 critical
CVE-2025-1960. CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system's default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interface.

// Remediations (2)

Patch: Hotfix WebHMI_Fix_users_for_Standard.V1 of WebHMI includes a fix for this vulnerability and can be o
Hotfix WebHMI_Fix_users_for_Standard.V1 of WebHMI includes a fix for this vulnerability and can be obtained from Schneider Electric Customer Care Center.
Mitigation: In addition to the remediation provided above, they should immediately apply the following mitigatio
In addition to the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Once the hotfix, WebHMI_Fix_users_for_Standard.V1, has been applied, we recommend ensuring that all hardening guidelines provided with the product are implemented to maintain best practices for defense in-depth. Specifically, the WebHMI should not be exposed to the internet. Contact Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp for assistance is required.

// References