Schneider-Electric
255 CVEs across 1763 Schneider-Electric products. Browse Schneider-Electric vulnerabilities, severities, and proof-of-concept exploits.
Schneider-Electric products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9718 | Medium | 6.5 | 2026-06-25 | CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availabi… |
CVE-2026-9717 | High | 7.2 | 2026-06-25 | CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of comman… |
CVE-2026-9716 | High | 7.5 | 2026-06-25 | CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionalit… |
CVE-2026-9651 | Medium | 4.4 | 2026-06-25 | CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account c… |
CVE-2026-9650 | High | 7.5 | 2026-06-25 | CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated atta… |
CVE-2026-8045 | Medium | 6.5 | 2026-06-09 | CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an… |
CVE-2026-6332 | High | 7.5 | 2026-05-14 | CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in reve… |
CVE-2026-6866 | High | 7.5 | 2026-05-12 | CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when cred… |
CVE-2026-2405 | Medium | 6.5 | 2026-04-14 | CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Ad… |
CVE-2026-2404 | Medium | 5.3 | 2026-04-14 | CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security… |
CVE-2026-2403 | Medium | 4.3 | 2026-04-14 | CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a… |
CVE-2026-2402 | Medium | 5.3 | 2026-04-14 | CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by perfo… |
CVE-2026-2401 | Medium | 5.0 | 2026-04-14 | CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user ex… |
CVE-2026-2400 | Medium | 4.3 | 2026-04-14 | CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web Ad… |
CVE-2026-2399 | Medium | 6.1 | 2026-04-14 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files overwritten with tex… |
CVE-2026-2273 | High | 8.2 | 2026-03-10 | CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering works… |
CVE-2026-1286 | Medium | 6.5 | 2026-03-10 | CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on wo… |
CVE-2025-13902 | Medium | 5.4 | 2026-03-10 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated… |
CVE-2025-13901 | Medium | 5.3 | 2026-03-10 | CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticate… |
CVE-2025-11739 | High | 7.8 | 2026-03-10 | CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authent… |
CVE-2025-13845 | High | 7.8 | 2026-01-15 | CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody. |
CVE-2025-13844 | Medium | 5.3 | 2026-01-15 | CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the a… |
CVE-2024-9409 | High | 7.5 | 2024-11-13 | CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a la… |
CVE-2024-10575 | Critical | 9.8 | 2024-11-13 | CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected device… |
CVE-2024-8422 | High | 7.8 | 2024-10-08 | CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when applicat… |
CVE-2024-8306 | High | 7.8 | 2024-09-11 | CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity and availability of the wo… |
CVE-2024-6407 | Critical | 9.8 | 2024-07-11 | CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to the device. |
CVE-2024-6528 | Medium | 5.4 | 2024-07-11 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a… |
CVE-2024-5681 | High | 7.8 | 2024-07-11 | CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a… |
CVE-2024-5680 | High | 7.1 | 2024-07-11 | CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts… |
CVE-2024-5679 | High | 7.1 | 2024-07-11 | CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access… |
CVE-2024-2602 | High | 7.3 | 2024-07-11 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code execution when an… |
CVE-2024-5559 | Medium | 6.1 | 2024-06-12 | CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full c… |
CVE-2024-2747 | High | 7.8 | 2024-06-12 | CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted fi… |
CVE-2024-0865 | High | 7.8 | 2024-06-12 | CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user. |
CVE-2024-5560 | Medium | 5.3 | 2024-06-12 | CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a specially crafted HT… |
CVE-2024-5558 | Medium | 6.4 | 2024-06-12 | CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited adm… |
CVE-2024-5557 | Medium | 4.5 | 2024-06-12 | CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacker has access to the… |
CVE-2024-37040 | Medium | 5.4 | 2024-06-12 | CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to the device’s web in… |
CVE-2024-37039 | Medium | 5.9 | 2024-06-12 | CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request. |
CVE-2024-37038 | High | 7.5 | 2024-06-12 | CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unautho… |
CVE-2024-37037 | High | 8.1 | 2024-06-12 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticated user with access… |
CVE-2024-37036 | Critical | 9.8 | 2024-06-12 | CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and particular configurat… |
CVE-2024-5313 | Medium | 6.5 | 2024-06-12 | CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to dir… |
CVE-2024-5056 | Medium | 6.5 | 2024-06-12 | CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behav… |
CVE-2023-6409 | High | 7.7 | 2024-02-14 | CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when op… |
CVE-2023-6408 | High | 8.1 | 2024-02-14 | CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service an… |
CVE-2023-27975 | High | 7.1 | 2024-02-14 | CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized access to the project file in EcoStruxure Control Expert when… |
CVE-2023-7032 | High | 7.8 | 2024-01-09 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges b… |
CVE-2023-6407 | Medium | 5.3 | 2023-12-14 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file deletion upon se… |
CVE-2023-5630 | Medium | 6.5 | 2023-12-14 | A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware. |
CVE-2023-5629 | High | 8.2 | 2023-12-14 | A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishing attempts over H… |
CVE-2023-6032 | Medium | 5.3 | 2023-11-15 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and f… |
CVE-2023-5987 | Medium | 6.1 | 2023-11-15 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross… |
CVE-2023-5986 | High | 8.2 | 2023-11-15 | A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By p… |
CVE-2023-5985 | Medium | 4.8 | 2023-11-15 | A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that could cause compromise of a user’s browser when an attacker w… |
CVE-2023-5984 | High | 7.2 | 2023-11-15 | A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins… |
CVE-2023-5399 | Critical | 9.8 | 2023-10-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the p… |
CVE-2023-5391 | Critical | 9.8 | 2023-10-04 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a… |
CVE-2023-5402 | Critical | 9.8 | 2023-10-04 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used over the network. |
CVE-2023-4516 | High | 7.8 | 2023-09-14 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker to change update sou… |
CVE-2023-3953 | Medium | 5.3 | 2023-08-09 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption when an authenticat… |
CVE-2023-29414 | High | 7.8 | 2023-07-12 | A CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) vulnerability exists that could cause user privilege escalation if a local use… |
CVE-2023-37199 | Medium | 6.8 | 2023-07-12 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tamp… |
CVE-2023-37198 | Medium | 6.8 | 2023-07-12 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE… |
CVE-2023-37197 | High | 8.8 | 2023-07-12 | A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user al… |
CVE-2023-37196 | High | 8.8 | 2023-07-12 | A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user alre… |
CVE-2023-3001 | High | 7.8 | 2023-06-14 | A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potent… |
CVE-2023-2570 | High | 7.0 | 2023-06-14 | A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execution when a malicio… |
CVE-2023-2569 | High | 7.8 | 2023-06-14 | A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, and potentially kernel execution when a… |
CVE-2023-1049 | High | 7.8 | 2023-06-14 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious use… |
CVE-2022-46680 | High | 8.8 | 2023-05-22 | A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denial of service, or mo… |
CVE-2023-2161 | Medium | 5.0 | 2023-05-16 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a mali… |
CVE-2023-25620 | Medium | 6.5 | 2023-04-19 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when a malicious p… |
CVE-2023-25619 | High | 7.5 | 2023-04-19 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when communicating o… |
CVE-2023-29410 | High | 7.2 | 2023-04-18 | A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the serve… |
CVE-2023-28004 | Critical | 9.8 | 2023-04-18 | A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted Ethernet request could result in denial of service or remote… |
CVE-2023-29413 | High | 7.5 | 2023-04-18 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on th… |
CVE-2023-29412 | Critical | 9.8 | 2023-04-18 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution… |
CVE-2023-29411 | Critical | 9.8 | 2023-04-18 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remo… |
CVE-2023-28003 | Medium | 6.7 | 2023-04-18 | A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME… |
CVE-2023-25555 | Medium | 5.6 | 2023-04-18 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a use… |
CVE-2023-25554 | High | 7.8 | 2023-04-18 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a local privilege es… |
CVE-2023-25553 | Medium | 6.1 | 2023-04-18 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE endpoint through the… |
CVE-2023-25552 | High | 8.1 | 2023-04-18 | A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauth… |
CVE-2023-25551 | Medium | 6.1 | 2023-04-18 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE file upload endpoint wh… |
CVE-2023-25550 | High | 7.2 | 2023-04-18 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostname” paramete… |
CVE-2023-25549 | High | 7.2 | 2023-04-18 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a parameter of… |
CVE-2023-25548 | High | 8.8 | 2023-04-18 | A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being properly secured whe… |
CVE-2023-25547 | High | 8.8 | 2023-04-18 | A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low pri… |
CVE-2022-43378 | Medium | 6.5 | 2023-04-18 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performing unintended… |
CVE-2022-43377 | High | 7.5 | 2023-04-18 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is p… |
CVE-2022-43376 | High | 7.6 | 2023-04-18 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session manipu… |
CVE-2022-34755 | Medium | 6.3 | 2023-04-18 | A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted fi… |
CVE-2023-25556 | High | 8.3 | 2023-04-18 | A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the at… |
CVE-2023-27976 | High | 8.8 | 2023-04-18 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a malicious link provided… |
CVE-2023-1548 | Medium | 5.5 | 2023-04-18 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the console server service… |
CVE-2023-27983 | Medium | 6.5 | 2023-03-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGS… |
CVE-2023-27979 | Medium | 6.5 | 2023-03-21 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project re… |
CVE-2023-27977 | Medium | 6.5 | 2023-03-21 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project r… |