EcoStruxure Power Monitoring Expert vulnerabilities
6 known vulnerabilities in EcoStruxure Power Monitoring Expert from Schneider Electric. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
EcoStruxure™ Power Monitoring Expert (PME): Deserialization of Untrusted Data
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
- 7.3 High severity
EcoStruxure Power Monitoring Expert (PME): Deserialization of Untrusted Data
CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server.
- 7.8 High severity
EcoStruxure Power Design - Ecodial: Deserialization of Untrusted Data
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user.
- 9.8 Critical severity
EcoStruxure Power Monitoring Expert: Deserialization of Untrusted Data
A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to the application.
- 8.8 High severity
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker…
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account.
- 8.8 High severity
A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated…
A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link