A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the server when a malicious payload is provided over HTTP for the server to execute.

A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the server when a malicious payload is provided over HTTP for the server to execute.

Schneider Electric is aware of a vulnerability in its Conext™ Gateway/ InsightHome and InsightFacility products. The InsightHome and InsightFacility products are smart edge devices that connect customers’ Schneider Electric solar and storage systems to the Insight app. InsightHome targets the residential solar and storage market globally. InsightFacility is for large residential and commercial solar and storage systems. Conext™ Gateway was discontinued from 2019 and rebranded as InsightFacility. However, Schneider is still supporting Gateway with firmware fixes. Failure to apply the remediations provided below may risk remote code execution, which could result in an authenticated user being able to insert a backdoor into the application or could allow the extraction of private certificates.