// Description
# Schneider Electric Security Notification
14-Mar-23 (10-Sep-24) Document Reference Number – SEVD-2023 -073-01 (v3.0.0) Page 1 of 5
# EcoStruxure™ Power Monitoring Expert EcoStruxure™ Power Operation
14 March 2023 (10 September 2024)
## Overview
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert product (PME) and EcoStruxure™ Power Operation product (EPO). EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power-critical and energy-intensive facilities maximize uptime and operational efficiency. EcoStruxure™ Power Operation (EPO) is an on-premises software that provides a single platform to monitor and control on premise power systems. Failure to apply the mitigation provided below may risk a session expiration vulnerability, which would allow an attacker unauthorized access over a hijacked session. September 2024 Update: EcoStruxure™ Power Operation has been added to the Affected Products table.
## Affected Products and Versions
Product Version EcoStruxure™ Power Monitoring Expert (PME) Versions EcoStruxure™ Power Monitoring Expert 2022 and prior EcoStruxure™ Power Operation (EPO) Versions EcoStruxure™ Power Operation 2022 CU4 and prior Versions EcoStruxure™ Power Operation 2021 CU3 Hotfix 2 and prior
## Vulnerability Details
CVE ID: CVE-2023-28003
CVSS v3.1 Base Score 6.7 | Medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session has signed out of their account.