IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2025-189-04 — EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) with Advanced Reporting and Dashboards

MEDIUM
CVSS 4.3
Date 2026-10-16T20:31:40+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 08-Jul-25 Document Reference Number – SEVD-2025-189-04 Page 1 of 5 # EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) with Advanced Reporting and Dashboards 8 July 2025 Overview Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) products. EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power critical and energy-intensive facilities maximize uptime and operational efficiency. Note: There are some instances of PME being deployed in a Managed Service model. EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) are on-premises software offers that provides a single platform to monitor and control medium and lower power systems. Failure to apply the remediation provided below may risk unintended data exposure to other authenticated users on that system. Affected Products and Versions Product Version EcoStruxure™ Power Monitoring Expert (PME) Version 2023 Version 2023 R2 Version 2024 Version 2024 R2 EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module Version 2022 w/ Advanced Reporting Module Version 2024 w/ Advanced Reporting Module Vulnerability Details CVE ID: CVE-2025-6788 CVSS v3.1 Base Score 4.3 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS v4.0 Base Score 5.3 | Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML diagrams.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2025-6788 4.3 critical
CVE-2025-6788. CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML diagrams.

// Affected Products (2)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module engineering_workstation
L3
2022
Schneider Electric Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) engineering_workstation
L3
2023

// Remediations (6)

Patch: Hotfix_256448_Diagrams-Release.13.1.25182.01 available for EcoStruxure™ Power Monitoring Expert (P
Hotfix_256448_Diagrams-Release.13.1.25182.01 available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.
Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the f
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: • We recommend you remove your TGML diagrams from your multitenant managed system or onpremises system and revert to using Vista diagrams.
Patch: Hotfix_256448_Diagrams-Release.13.0.25182.0 available for EcoStruxure™ Power Monitoring Expert (PM
Hotfix_256448_Diagrams-Release.13.0.25182.0 available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.
Patch: Hotfix_199767 available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for thi
Hotfix_199767 available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.
Patch: Hotfix_199767 is available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for
Hotfix_199767 is available for EcoStruxure™ Power Monitoring Expert (PME) that includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this hotfix.
Patch: Hotfix_256448_Diagrams-Release.13.0.25182.01 Contact Schneider Electric’s Customer Care Center to
Hotfix_256448_Diagrams-Release.13.0.25182.01 Contact Schneider Electric’s Customer Care Center to download this hotfix.

// References