Schneider-Electric Ecostruxure Power Monitoring Expert
14 CVEs affecting Schneider-Electric Ecostruxure Power Monitoring Expert. Latest disclosed: 2026-03-10. Critical: 1, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5391 | Critical | 9.8 | 2023-10-04 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a… |
CVE-2022-22727 | High | 8.8 | 2022-02-04 | A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the… |
CVE-2021-22827 | High | 8.8 | 2022-01-28 | A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload… |
CVE-2021-22826 | High | 8.8 | 2022-01-28 | A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload… |
CVE-2020-7547 | High | 8.8 | 2020-12-01 | A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for v… |
CVE-2023-5986 | High | 8.2 | 2023-11-15 | A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By p… |
CVE-2025-11739 | High | 7.8 | 2026-03-10 | CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authent… |
CVE-2020-7545 | High | 7.2 | 2020-12-01 | A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for ve… |
CVE-2023-28003 | Medium | 6.7 | 2023-04-18 | A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME… |
CVE-2022-22726 | Medium | 6.5 | 2022-02-04 | A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited ope… |
CVE-2023-5987 | Medium | 6.1 | 2023-11-15 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross… |
CVE-2018-7797 | Medium | 6.1 | 2018-12-17 | A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all… |
CVE-2022-22804 | Medium | 5.4 | 2022-02-04 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker… |
CVE-2020-7546 | Medium | 5.4 | 2020-12-01 | A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Softwa… |