Schneider Electric EcoStruxure Power Operation multiple component flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Six vulnerabilities in Pillow, libvpx, Envoy and HTTP/2 in EcoStruxure Power Operation 2022/2024 enable code execution, buffer overflow and denial of service.
CISA advisory ICSA-25-203-04 documents six vulnerabilities affecting Schneider Electric EcoStruxure Power Operation (EPO) 2022 through CU6 and EPO 2024 through CU1. The vulnerabilities stem from outdated third-party components: Pillow (arbitrary code execution via PIL.ImageMath.eval, buffer overflow in _imagingcms.c, GIF data amplification), libvpx (heap buffer overflow in VP8 encoding), Envoy/nghttp2 (HTTP/2 header map memory leak), and HTTP/2 protocol handling (rapid stream cancellation DoS). Successful exploitation could result in loss of system functionality or unauthorized access. The advisory affects critical infrastructure sectors including energy, commercial facilities, and critical manufacturing worldwide. EcoStruxure Power Operation 2022 CU7 includes updated PostgreSQL and is available for download. For organizations unable to patch immediately, Schneider Electric recommends uninstalling PostgreSQL if waveform analysis and ETAP simulation features are unused, or restricting PostgreSQL to localhost-only connections for organizations that require those features. Manual update from PostgreSQL 14.10 to 14.17 or higher is also recommended. No evidence of active exploitation in the wild is documented in this advisory.
Mentioned in this report
Detection guidance
Python Process Invoking PIL ImageMath Eval
Detects python executing code that calls Pillow ImageMath eval functions, the primitive abused for arbitrary code execution in outdated Pillow builds bundled with EPO. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Python Process Invoking PIL ImageMath Eval
id: 2d700aa8-c352-51b9-a3a1-6d5275511c4d
status: experimental
description: Detects Python interpreters launched with a command line that references
PIL ImageMath eval or unsafe_eval. This is the code-execution primitive in vulnerable
Pillow versions (CVE-2023-50447 class) bundled in components such as EcoStruxure
Power Operation. Generalises on the API call pattern, not on any payload string.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \python.exe
- \pythonw.exe
- \py.exe
selection_cmd:
CommandLine|contains|all:
- ImageMath
- eval
condition: selection_img and selection_cmd
falsepositives:
- Developers or image-processing scripts that legitimately use ImageMath on a workstation
with inline python -c
- Security testing or vulnerability scanners validating Pillow versions
level: medium
author: Vorant
Non-Local Inbound Connection to PostgreSQL Server Process
Detects PostgreSQL accepting connections from non-loopback sources, which the vendor mitigation says should be restricted to localhost on EPO hosts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Local Inbound Connection to PostgreSQL Server Process
id: 3aacd6e1-7c0c-552d-9f63-fc71aa0be017
status: experimental
description: Detects inbound network connections to postgres.exe on port 5432 from
a non-loopback source address. Schneider Electric's mitigation for EcoStruxure Power
Operation is to restrict PostgreSQL to localhost, so remote connections indicate
exposure to the vulnerable component or probing. Scope to EPO hosts and add known
remote DB clients to the filter.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
tags:
- attack.impact
- attack.t1499
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \postgres.exe
Initiated: 'false'
DestinationPort: 5432
filter_local:
SourceIp:
- 127.0.0.1
- ::1
condition: selection and not filter_local
falsepositives:
- Legitimate remote database administration or reporting clients connecting to PostgreSQL
- Approved ETAP or waveform analysis servers on separate hosts
level: low
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs