# Schneider Electric EcoStruxure Power Operation multiple component flaws

Published: 2026-02-26 · Severity: high · Sectors: energy, manufacturing, infrastructure
Canonical: https://vorant.io/reports/954be085-40dc-5483-95b7-148c5fe2c6ac/schneider-electric-ecostruxure-power-operation-multiple-component-flaws

> Six vulnerabilities in Pillow, libvpx, Envoy and HTTP/2 in EcoStruxure Power Operation 2022/2024 enable code execution, buffer overflow and denial of service.

CISA advisory ICSA-25-203-04 documents six vulnerabilities affecting Schneider Electric EcoStruxure Power Operation (EPO) 2022 through CU6 and EPO 2024 through CU1. The vulnerabilities stem from outdated third-party components: Pillow (arbitrary code execution via PIL.ImageMath.eval, buffer overflow in _imagingcms.c, GIF data amplification), libvpx (heap buffer overflow in VP8 encoding), Envoy/nghttp2 (HTTP/2 header map memory leak), and HTTP/2 protocol handling (rapid stream cancellation DoS). Successful exploitation could result in loss of system functionality or unauthorized access. The advisory affects critical infrastructure sectors including energy, commercial facilities, and critical manufacturing worldwide. EcoStruxure Power Operation 2022 CU7 includes updated PostgreSQL and is available for download. For organizations unable to patch immediately, Schneider Electric recommends uninstalling PostgreSQL if waveform analysis and ETAP simulation features are unused, or restricting PostgreSQL to localhost-only connections for organizations that require those features. Manual update from PostgreSQL 14.10 to 14.17 or higher is also recommended. No evidence of active exploitation in the wild is documented in this advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2022-45198, CVE-2023-35945, CVE-2023-44487 (KEV), CVE-2023-50447, CVE-2023-5217 (KEV), CVE-2024-28219

## Detection guidance (public sample)

### Python Process Invoking PIL ImageMath Eval

ATT&CK: T1203

Detects python executing code that calls Pillow ImageMath eval functions, the primitive abused for arbitrary code execution in outdated Pillow builds bundled with EPO. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Python Process Invoking PIL ImageMath Eval
id: 2d700aa8-c352-51b9-a3a1-6d5275511c4d
status: experimental
description: Detects Python interpreters launched with a command line that references
  PIL ImageMath eval or unsafe_eval. This is the code-execution primitive in vulnerable
  Pillow versions (CVE-2023-50447 class) bundled in components such as EcoStruxure
  Power Operation. Generalises on the API call pattern, not on any payload string.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \python.exe
    - \pythonw.exe
    - \py.exe
  selection_cmd:
    CommandLine|contains|all:
    - ImageMath
    - eval
  condition: selection_img and selection_cmd
falsepositives:
- Developers or image-processing scripts that legitimately use ImageMath on a workstation
  with inline python -c
- Security testing or vulnerability scanners validating Pillow versions
level: medium
author: Vorant
```

### Non-Local Inbound Connection to PostgreSQL Server Process

ATT&CK: T1499

Detects PostgreSQL accepting connections from non-loopback sources, which the vendor mitigation says should be restricted to localhost on EPO hosts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Non-Local Inbound Connection to PostgreSQL Server Process
id: 3aacd6e1-7c0c-552d-9f63-fc71aa0be017
status: experimental
description: Detects inbound network connections to postgres.exe on port 5432 from
  a non-loopback source address. Schneider Electric's mitigation for EcoStruxure Power
  Operation is to restrict PostgreSQL to localhost, so remote connections indicate
  exposure to the vulnerable component or probing. Scope to EPO hosts and add known
  remote DB clients to the filter.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04
tags:
- attack.impact
- attack.t1499
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \postgres.exe
    Initiated: 'false'
    DestinationPort: 5432
  filter_local:
    SourceIp:
    - 127.0.0.1
    - ::1
  condition: selection and not filter_local
falsepositives:
- Legitimate remote database administration or reporting clients connecting to PostgreSQL
- Approved ETAP or waveform analysis servers on separate hosts
level: low
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/954be085-40dc-5483-95b7-148c5fe2c6ac/schneider-electric-ecostruxure-power-operation-multiple-component-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup