A path traversal vulnerability in Schneider Electric EcoStruxure software allows an authenticated administrator to execute arbitrary code, posing a severe risk to system integrity.

The vulnerability is a path traversal flaw (CWE-22) that occurs during file upload operations. It requires an attacker to possess administrative privileges to successfully upload and execute a malicious file over HTTP.

Successful exploitation of this vulnerability allows an attacker with administrative access to execute arbitrary code on the host system. Given the CVSS score of 7.2, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and significant operational disruption within critical power management environments.

Immediate Action: Review the official security notice provided by Schneider Electric (SEVD-2025-224-02) and apply all available security updates or configuration changes specified by the vendor.

Proactive Monitoring: Monitor system logs for unusual file upload activity or unauthorized processes executing from web-accessible directories.

Compensating Controls: Implement strict network segmentation to limit access to the management interface and utilize a Web Application Firewall (WAF) to inspect incoming HTTP requests for path traversal patterns.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a significant risk to industrial and power management systems by allowing code execution through administrative file uploads. Organizations should prioritize verifying the security posture of their EcoStruxure deployments and ensure that administrative access is restricted to authorized personnel only. Please monitor the Schneider Electric security portal for the immediate release of patches to mitigate this risk.