EcoStruxure™ Power Monitoring Expert (PME) vulnerabilities
6 known vulnerabilities in EcoStruxure™ Power Monitoring Expert (PME) from Schneider Electric. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
EcoStruxure™ Power Monitoring Expert (PME): Deserialization of Untrusted Data
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
- 7.2 High severity
EcoStruxure™ Power Monitoring Expert (PME): Improper Limitation of a Pathname to a Restricted Directory
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed.
- 7.5 High severity
EcoStruxure™ Power Monitoring Expert (PME): Server-Side Request Forgery
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url.
- 7.5 High severity
EcoStruxure™ Power Monitoring Expert (PME): Server-Side Request Forgery
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint.
- 8.7 High severity
EcoStruxure™ Power Monitoring Expert (PME): Deserialization of Untrusted Data
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.
- 7.3 High severity
EcoStruxure Power Monitoring Expert (PME): Deserialization of Untrusted Data
CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server.