CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user.

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user.

All versions of Schneider Electric EcoStruxure Power Design - Ecodial NL, INT, and FR deserializes untrusted data which could allow an attacker to perform code execution when a malicious project file is loaded into the application by a valid user.

Schneider Electric is aware of a vulnerability in its EcoStruxure Power Design - Ecodial product. The EcoStruxure Power Design - Ecodial product is a software that helps optimize equipment and costs while managing operating specifications, all along with the design of power distribution projects. Failure to apply the provided below may risk deserialization of untrusted data, which could result in Remote Code Execution