Schneider Electric Uni-Telway Driver DoS flaw across products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Improper input validation in Schneider Electric Uni-Telway driver affects multiple EcoStruxure products; authenticated local users can cause denial of service.
Schneider Electric has disclosed CVE-2024-10083, an improper input validation vulnerability (CWE-20) in its Uni-Telway driver component that affects multiple engineering and automation products. The vulnerability allows an authenticated user with local access to invoke specific driver interfaces with crafted input, causing denial of service of the engineering workstation and potentially interrupting engineering operations. The issue affects all versions of Uni-Telway driver as deployed in EcoStruxure Control Expert, EcoStruxure Process Expert, EcoStruxure Process Expert for AVEVA System Platform, and OPC Factory Server across critical infrastructure sectors including commercial facilities, critical manufacturing, and energy worldwide.
Since the vulnerability requires local authentication and direct workstation access, the risk is primarily to engineering operations and authorized personnel. No remote exploitation vector is documented. Schneider Electric recommends uninstalling the driver where not required; newer versions (16.2 of Control Expert, 2025 of Process Expert, and 3.63SP3 of OPC Factory Server) no longer include Uni-Telway by default. For those requiring the driver, mitigations include application control via McAfee tools and adherence to Schneider Electric's cybersecurity hardening guidelines. As of January 2026, mitigations for EcoStruxure Process Expert are now available.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs