IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2024-282-06 — Zelio Soft 2

HIGH
CVSS 7.8
Date 2026-10-16T20:33:23+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 08-Oct-24 Document Reference Number – SEVD-2024-282-06 Page 1 of 4 ## Zelio Soft 2 8 October 2024 ## Overview Schneider Electric is aware of vulnerabilities in its Zelio Soft 2 product. The Zelio Soft 2 software for Zelio Logic smart relays (SR2/ SR3) enables programming in LADDER language or in function block diagram (FBD) language simulation, monitoring and supervision uploading and downloading of programs output of personalized files automatic compiling of programs. Failure to apply the fix provided below may risk remote code execution, which could result in resource exhaustion, information disclosure, or denial of service. ## Affected Products and Versions Product Version Zelio Soft 2 Versions prior to 5.4.2.2 ## Vulnerability Details CVE ID: CVE-2024-8422 CVSS v3.1 Base Score 7.8 | High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when application user opens a malicious Zelio Soft 2 project file. CVE ID: CVE-2024-8518 CVSS v3.1 Base Score 3.3 | Low | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CWE-20: Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft 2 application when a specially crafted project file is loaded by an application user. Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Schneider Electric Security Notification 08-Oct-24 Document Reference Number – SEVD-2024-282-06 Page 2 of 4

// Vulnerabilities (2)

CVE ID CVSS Score Severity Description
CVE-2024-8518 7.8 high
An Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft 2 application if a specially crafted project file is loaded by an application user.
CVE-2024-8422 7.8 high
A Use After Free vulnerability exists that could cause arbitrary code execution, denial-of-service and loss of confidentiality & integrity if an application user opens a malicious Zelio Soft 2 project file.

// Remediations (1)

Mitigation: Schneider Electric recommends that customers update to Version 5.4.2.2. It can be updated through th
Schneider Electric recommends that customers update to Version 5.4.2.2. It can be updated through the Schneider Electric Software Update (SESU) application and is also available for download here.

// References