CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an attacker with a Data Center Expert user account submits crafted XML payloads to SOAP service endpoints.
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
CVE-2026-6865 is a path traversal vulnerability (CWE-22) in Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller. It allows unauthorized access to sensitive files due to improper handling of user-supplied input during server-side file path processing. The vulnerability affects versions up to and including 11.06.31. It has a high severity with a CVSS 4.0 base score of 7.1. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
We strongly recommend the following industry cybersecurity best practices.
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious file provided by an attacker.
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web Admin user alters the POST /setPCBEDesc request payload.
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload.
CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints.
CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security check request payload.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files overwritten with text data when a Web Admin user alters the POST /REST/upssleep request payload.
CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacker is able to interrogate the SNMP port.
CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of the subsequent system when an authenticated user opens a malicious project file.
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file.
CVE-2025-13902 is a medium-severity cross-site scripting (XSS) vulnerability affecting Schneider Electric Modicon Controllers M241 and M251 prior to version 5.4.13.12. It arises from improper neutralization of input during web page generation, allowing authenticated attackers to inject malicious JavaScript. The attack requires the victim to interact by hovering over a crafted element on the affected web interface, which then executes the injected script in the victim's browser. This vulnerability does not require user authentication to be bypassed but does require the attacker to have some level of authenticated access to the device. Exploitation can lead to session hijacking, unauthorized actions, or information disclosure within the context of the victim’s browser session. No known exploits are currently reported in the wild. Organizations using these Schneider Electric controllers should prioritize patching to prevent potential exploitation.
CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.
CVE-2025-13957 is a high-severity vulnerability in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) version 9.0 and prior. It involves the use of hard-coded credentials (CWE-798) that could lead to information disclosure and remote code execution if the SOCKS Proxy feature is enabled. By default, SOCKS Proxy is disabled, reducing the attack surface. Exploitation requires knowledge of administrator and PostgreSQL database credentials. No patch or official remediation information is currently provided by the vendor.
CVE-2026-1226 is a high-severity code injection vulnerability (CWE-94) in Schneider Electric's EcoStruxure Building Operation Workstation versions prior to 7.0.2. The flaw arises from improper control over code generation when processing maliciously crafted TGML graphics files, potentially allowing execution of untrusted code. Exploitation requires local access with low privileges and some user interaction, but no authentication is needed beyond local privileges. This vulnerability can severely impact confidentiality, integrity, and availability of building management systems. No known exploits are reported in the wild yet. European organizations using affected Schneider Electric building operation software should prioritize patching and implement strict file validation and access controls. Countries with high adoption of Schneider Electric products and critical infrastructure reliance, such as Germany, France, UK, and the Netherlands, are most at risk. The CVSS score of 7 reflects the significant risk posed by this vulnerability in operational technology environments.
