Schneider Electric
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Schneider Electric product.
RSS Feeds for Schneider Electric security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Schneider Electric products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Schneider Electric Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2026 there have been 11 vulnerabilities in Schneider Electric. Last year, in 2025 Schneider Electric had 12 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Schneider Electric in 2026 could surpass last years number.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 11 | 0.00 |
| 2025 | 12 | 6.35 |
| 2024 | 16 | 7.69 |
| 2023 | 66 | 8.20 |
| 2022 | 49 | 7.88 |
| 2021 | 38 | 7.43 |
| 2020 | 48 | 7.78 |
| 2019 | 19 | 8.55 |
| 2018 | 62 | 5.55 |
It may take a day or so for new Schneider Electric vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Schneider Electric Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-2273 | Mar 10, 2026 |
Schneider Electric Engine Workstation Code Injection via Malicious Project FileCWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of the subsequent system when an authenticated user opens a malicious project file. |
|
| CVE-2026-1286 | Mar 10, 2026 |
Untrusted data deserialization in Schneider file leads to RCE (CWE-502)CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file. |
|
| CVE-2025-13902 | Mar 10, 2026 |
CVE-2025-13902: Authenticated XSS via Hover in Schneider Electric WebCWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victims browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload. |
|
| CVE-2025-13901 | Mar 10, 2026 |
Machine Expert PROT: Improper Shutdown Leads to Denial of ServiceCWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels. |
|
| CVE-2025-11739 | Mar 10, 2026 |
CWE502 Unsafe Deserialization in Schneider Electric DeviceCWE502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization. |
Ecostruxure Power Monitoring Expert
|
| CVE-2025-13957 | Mar 10, 2026 |
Hardcoded Credentials in Schneider Proxy Enable Remote Code ExecutionCWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default. |
Data Center Expert
Struxureware Data Center Expert
|
| CVE-2026-1226 | Feb 11, 2026 |
TGML Graphics File Code Execution Vulnerability (CWE-94)CWE94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file. |
|
| CVE-2026-1227 | Feb 11, 2026 |
EBO System XEE Vulnerability in TGML UploadCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from Workstation. |
|
| CVE-2025-13905 | Jan 29, 2026 |
Schneider: CVE-2025-13905 Incorrect Default Permissions Enable Priv Esc via ShellCWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable service binaries are modified in the installation folder by a local user with normal privilege upon service restart. |
Ecostruxure Process Expert
|
| CVE-2025-13845 | Jan 15, 2026 |
Use-After-Free in Rapsody SSD Import RCECWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody. |
Ecostruxure Power Build Rapsody
|
| CVE-2025-13844 | Jan 15, 2026 |
Rapsody DF: Heap Corruption via malicious SSD importCWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody. |
Ecostruxure Power Build Rapsody
|
| CVE-2025-11567 | Nov 12, 2025 |
Elevated Access via Improper Default Permissions on Install FolderCWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured. |
Powerchute
|
| CVE-2025-11566 | Nov 12, 2025 |
Local Auth Bypass via Unrestricted Attempts on /REST/shutdownnowCWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint. |
Powerchute
|
| CVE-2025-11565 | Nov 12, 2025 |
Path Traversal in WebSphere UpdateJRE REST API Allows Local Admin ElevationCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload. |
Powerchute
|
| CVE-2025-7746 | Sep 09, 2025 |
CVE-2025-7746 XSS Vulnerability in Unknown Web AppCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victims browser. |
|
| CVE-2025-50125 | Jul 11, 2025 |
SSRF in Unknown Service Enables UAC RCEA CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of host request header. |
Data Center Expert
|
| CVE-2025-50124 | Jul 11, 2025 |
Setup Script PrivEsc Vulnerability (CVE-2025-50124)A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script. |
Data Center Expert
|
| CVE-2025-50123 | Jul 11, 2025 |
CWE-94: Hostname Code Injection Enables Remote Command ExecA CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input. |
Data Center Expert
|
| CVE-2025-50122 | Jul 11, 2025 |
Insufficient Entropy in Root Password Generation Enables DiscoveryA CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts. |
Data Center Expert
|
| CVE-2025-50121 | Jul 11, 2025 |
OS Command Injection via Web Interface Folder Creation RCEA CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP is disabled by default. |
Data Center Expert
|
| CVE-2025-6438 | Jul 11, 2025 |
Improper XEE in SOAP API Allows Unauthorized File AccessA CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account. |
Data Center Expert
|
| CVE-2025-5743 | Jun 10, 2025 |
OS Command Injection in EV Charging Station Web UI allowing remote controlCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote control over the charging station when an authenticated user modifies configuration parameters on the web server. |
|
| CVE-2025-5740 | Jun 10, 2025 |
Web Server Path Traversal -> Unauth Unrestricted File Write (CWE-22)CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file writes when an authenticated user on the web server manipulates file path. |
|
| CVE-2024-10575 | Nov 13, 2024 |
Missing Authorization Vulnerability in Cisco IOS XE SoftwareCWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected devices. |
Ecostruxure It Gateway
|
| CVE-2024-8422 | Oct 08, 2024 |
Use-After-Free in Zelio Soft 2 Enables Arbitrary Code ExecutionCWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when application user opens a malicious Zelio Soft 2 project file. |
Zelio Soft 2
|
| CVE-2024-8306 | Sep 11, 2024 |
CVE-2024-8306: Improper Privilege Management in Workstation BinariesCWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity and availability of the workstation when non-admin authenticated user tries to perform privilege escalation by tampering with the binaries. |
Vijeo Designer Embedded Ecostruxure Machine Expert
Vijeo Designer
|
| CVE-2024-5681 | Jul 11, 2024 |
Foxboro.sys IOCTL Input Validation Flaw Enables DoS, PrivEsc, Kernel ExecCWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. |
Ecostruxure Foxboro Dcs Control Core Services
|
| CVE-2024-5680 | Jul 11, 2024 |
Foxboro.sys Improper Array Index Validation Leads to Local DoS via IOCTLCWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. |
Ecostruxure Foxboro Dcs Control Core Services
|
| CVE-2024-5679 | Jul 11, 2024 |
Foxboro.sys OOB Write via malicious IOCTL local DoS & memory leakCWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. |
Ecostruxure Foxboro Dcs Control Core Services
|
| CVE-2024-2602 | Jul 11, 2024 |
Path Traversal in Project File Execution Causing RCE (CVE-2024-2602)CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code execution when an authenticated user executes a saved project file that has been tampered by a malicious actor. |
Foxrtu Station
|
| CVE-2024-0865 | Jun 12, 2024 |
Hardcoded credentials local privilege escalation (CVE-2024-0865)CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user. |
Ecostruxure It Gateway
|
| CVE-2024-5559 | Jun 12, 2024 |
IoT Relay Device Reset Token Uses Broken Crypto - CVE-2024-5559CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full control of the relay when a specially crafted reset token is entered into the front panel of the device. |
Powerlogic P5 Firmware
|
| CVE-2024-2747 | Jun 12, 2024 |
Easergy Studio Priv Escal by Unquoted Search PathCWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted file name on the system and reboots the machine. |
Easergy Studio
|
| CVE-2024-37036 | Jun 12, 2024 |
Apache Tomcat Auth Bypass via Malformed POST (CWE787)CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and particular configuration parameters are set. |
Sage Rtu Firmware
|
| CVE-2024-5313 | Jun 12, 2024 |
CVE-2024-5313: SSH Interface Broad Exposure Over Network DoS PotentialCWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to directly exploit the product or make any unintended operation as the SSH interface access is protected by an authentication mechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts to perform a potential denial of service attack on the exposed SSH interface. |
Evlink Home Firmware
|
| CVE-2023-6408 | Feb 14, 2024 |
CVE-2023-6408: Message Integrity Failure in Controller Comm Channel (DoS & MI)CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack. |
Ecostruxure Control Expert
Ecostruxure Process Expert
|
| CVE-2023-27975 | Feb 14, 2024 |
Insufficiently Protected Credentials (IPC) in EcoStruxure Control ExpertCWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized access to the project file in EcoStruxure Control Expert when a local user tampers with the memory of the engineering workstation. |
Ecostruxure Control Expert
Ecostruxure Process Expert
|
| CVE-2023-6409 | Feb 14, 2024 |
Hardcoded Credentials in EcoStruxure Control Expert (CWE798)CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when opening the file with EcoStruxure Control Expert. |
Ecostruxure Control Expert
Ecostruxure Process Expert
|
| CVE-2023-7032 | Jan 09, 2024 |
Priv Escal via PHP Deserialization (CWE-502) CVE-2023-7032A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object. |
Easergy Studio
|
| CVE-2023-5984 | Nov 15, 2023 |
IoT Firmware Update Flaw: Code Upload w/o Integrity Check (CVE-2023-5984)A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in full control over the device. |
|
| CVE-2023-5987 | Nov 15, 2023 |
XSS Vulnerability (CWE-79) Improper Input Neutralization in Web PageA CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross site scripting condition where attackers can have a victims browser run arbitrary JavaScript when they visit a page containing the injected payload. |
Ecostruxure Power Monitoring Expert
|
| CVE-2023-5986 | Nov 15, 2023 |
WebApp OpenRedirect CVE-2023-5986: URL Redirection to Untrusted SiteA CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers can cause the softwares web application to redirect to the chosen domain after a successful login is performed. |
Ecostruxure Power Monitoring Expert
|
| CVE-2023-5399 | Oct 04, 2023 |
C-Bus Path Traversal: Remote File Tampering via File CommandA CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the personal computer running C-Bus when using the File Command. |
Spacelogic C Bus Toolkit
|
| CVE-2023-5391 | Oct 04, 2023 |
CWE-502 Deserialization RCE via Crafted PacketA CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to the application. |
Ecostruxure Power Scada Operation With Advanced Reports
Ecostruxure Power Operation With Advanced Reports
Ecostruxure Power Monitoring Expert
And others... |
| CVE-2023-5402 | Oct 04, 2023 |
CWE-269 Privilege Escalation via Transfer Command (CVE-2023-5402)A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network. |
C Bus Toolkit
|
| CVE-2023-4516 | Sep 14, 2023 |
Local Auth Bypass in IGSS Update ServiceA CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update source, potentially leading to remote code execution when the attacker force an update containing malicious content. |
Interactive Graphical Scada System
|
| CVE-2023-3953 | Aug 09, 2023 |
GP-Pro EX Log Parsing Buffer OverflowA CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption when an authenticated user opens a tampered log file from GP-Pro EX. |
Pro Face Gp Pro Ex
|
| CVE-2023-29414 | Jul 12, 2023 |
Local Buffer Overflow Enables Privilege EscalationA CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) vulnerability exists that could cause user privilege escalation if a local user sends specific string input to a local function call. |
Accutech Manager
|
| CVE-2023-37199 | Jul 12, 2023 |
DCE Remote Code Execution via Backup Manipulation (CWE-94)A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored. |
Struxureware Data Center Expert
|
| CVE-2023-37198 | Jul 12, 2023 |
DCE Admin Remote Code Exec via Install Package InjectionA CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages. |
Struxureware Data Center Expert
|