A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ and SmartStruxure™ Power Monitoring & SCADA Software. Failure to apply the mitigation provided below may risk remote code execution, which could result in an attacker gaining root level access to the underlying operating system on the impacted server.