IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2024-254-02 — EcoStruxure™ Power Monitoring Expert and EcoStruxure™ Power Operation or EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards

MEDIUM
CVSS 5.4
Date 2026-10-16T20:33:33+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 10-Sep-24 Document Reference Number – SEVD-2024-254-02 Page 1 of 7 ## EcoStruxure™ Power Monitoring Expert and EcoStruxure™ Power Operation or EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards 10 September 2024 Overview Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and EcoStruxure™ Power Operation (EPO) products. EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power. critical and energy-intensive facilities maximize uptime and operational efficiency. EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) are on-premises software offers that provides a single platform to monitor and control medium and lower power systems. Failure to apply the remediations provided below could result in execution of malicious web code, or unintended software operation. Affected Products and Versions Product Version EcoStruxure™ Power Monitoring Expert (PME) 2021 EcoStruxure™ Power Monitoring Expert 2021 CU1 and prior EcoStruxure™ Power Monitoring Expert (PME) 2020 EcoStruxure™ Power Monitoring Expert 2020 CU3 and prior EcoStruxure™ Power Operation (EPO) 2022 EcoStruxure™ Power Operation 2022 CU4 and prior EcoStruxure™ Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module EcoStruxure™ Power Operation 2022 CU4 and prior NOTE: EcoStruxure™ Power Operation 2022 with Advanced Reporting AND EcoStruxure™ Power Operation 2021 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. Schneider Electric Security Notification 10-Sep-24 Document Reference Number – SEVD-2024-254-02 Page 2 of 7

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2024-8401 5.4 critical
CVE-2024-8401. CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.

// Affected Products (7)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) 2020 engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure™ Power Operation (EPO) 2021 engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure™ Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module scada_server
L2
--
Schneider Electric Schneider Electric EcoStruxure™ Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure™ Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure™ Power Operation (EPO) 2022 engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) 2021 engineering_workstation
L3
--

// Remediations (5)

Patch: EcoStruxure™ Power Operations 2021 CU3 Hotfix 3 includes a fix for this vulnerability and is availa
EcoStruxure™ Power Operations 2021 CU3 Hotfix 3 includes a fix for this vulnerability and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2022- Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058 OR Upgrade to latest version of EcoStruxure™ Power Operations. Contact the customer care center for more information. Additionally, EcoStruxure™ Power Operation 2021 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You will need to update the version of EcoStruxure™ Power Monitoring Expert installed independently of the EcoStruxure™ Power Operation patch level installed and apply the appropriate EcoStruxure™ Power Monitoring Expert update as outlined above. For assistance in determining the version of PME installed, contact the Schneider Electric Customer Care Center.
Patch: EcoStruxure™ Power Monitoring Expert 2020 is at its end-of-life support. Customers should consider
EcoStruxure™ Power Monitoring Expert 2020 is at its end-of-life support. Customers should consider upgrading to the latest version offering of PME to resolve this issue. Please contact Schneider Electric Customer Care Center for more details.
Patch: EcoStruxure™ Power Operations 2022 CU5 includes a fix for this vulnerability and is available for d
EcoStruxure™ Power Operations 2022 CU5 includes a fix for this vulnerability and is available for download here: https://community.se.com/t5/EcoStruxure-Power-Operation/v2022- Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058 OR Upgrade to latest version of EcoStruxure™ Power Operations. Contact the customer care center for more information. Additionally, EcoStruxure™ Power operation 2022 with Advanced Reporting utilizes EcoStruxure™ Power Monitoring Expert. You will need to update the version of EcoStruxure™ Power Monitoring Expert installed independently of the EcoStruxure™ Power Operation patch level installed and apply the appropriate EcoStruxure™ Power Monitoring Expert update as outlined above. For assistance in determining the version of PME installed, contact the Schneider Electric Customer Care Center.
Patch: EcoStruxure™ Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module is at its
EcoStruxure™ Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module is at its end-of-life support. Customers should consider upgrading to the latest version offering of EPO to resolve this issue. Please contact Schneider Electric Customer Care Center for more details.
Patch: EcoStruxure™ Power Monitoring Expert 2021 CU2 includes a fix for this vulnerability and is availabl
EcoStruxure™ Power Monitoring Expert 2021 CU2 includes a fix for this vulnerability and is available for download here: https://ecoxpert.se.com/software-center/power-monitoringexpert/ power-monitoring-expert-2021 OR EcoStruxure™ Power Monitoring Expert 2022 includes a fix for this vulnerability and is available for download here: https://ecoxpert.se.com/software-center/power-monitoringexpert/ power-monitoring-expert-2022 OR Upgrade to the latest version of EcoStruxure™ Power Monitoring Expert. Contact the customer care center for more information.

// References