CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.

Schneider Electric is aware of multiple vulnerabilities in EcoStruxure™ Building Operation Enterprise Server, EcoStruxure™ Building Operation Enterprise Central, and EcoStruxure™ Workstation.

[EcoStruxure™ Building Operation (EBO)](https://www.se.com/us/en/product-range/62111-ecostruxure-building-operation-software/#overview) is an open and scalable software platform providing insight, control and management of multiple building systems and devices in one mobile-enabled convenient view. It delivers valuable data for decision-making to improve energy management and increase efficiency for better building performance and comfort, reduced carbon, and more sustainable building environments.

Failure to apply the remediations below may risk credential theft and subsequent unauthorized access and remote code execution from within the BMS network, which could result in data breaches, and operational disruptions.

September 2025 Update: Updated affected and fixed version details.

Schneider Electric is aware of multiple vulnerabilities in EcoStruxure™ Building Operation Enterprise Server, EcoStruxure™ Building Operation Enterprise Central, and EcoStruxure™ Workstation.

[EcoStruxure™ Building Operation (EBO)](https://www.se.com/us/en/product-range/62111-ecostruxure-building-operation-software/#overview) is an open and scalable software platform providing insight, control and management of multiple building systems and devices in one mobile-enabled convenient view. It delivers valuable data for decision-making to improve energy management and increase efficiency for better building performance and comfort, reduced carbon, and more sustainable building environments.

Failure to apply the remediations below may risk credential theft and subsequent unauthorized access and remote code execution from within the BMS network, which could result in data breaches, and operational disruptions.

September 2025 Update: Updated affected and fixed version details.