A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.

A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.

A deserialization of untrusted data vulnerability exists in Schneider Electric Easergy Studio versions prior to v9.3.5 that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.

Schneider Electric is aware of a vulnerability in our Easergy Studio product. The Easergy Studio product is a software solution for configuring, monitoring, and managing control devices. Failure to apply the remediations provided below may risk an attacker with a user level account on the engineering workstation to escalate privileges which could result in an attacker gaining full control of the targeted workstation