Schneider Electric EcoStruxure vulnerabilities enable RCE and data access
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Five vulnerabilities in Schneider Electric power management software allow remote code execution and data exfiltration; no active exploitation reported.
Schneider Electric has released a CISA advisory addressing five vulnerabilities across EcoStruxure Power Monitoring Expert (PME), Power Operation (EPO), and Power SCADA Operation (PSO) products. The vulnerabilities include deserialization of untrusted data (CVE-2025-54923, CVSS 8.8), two server-side request forgery (SSRF) flaws enabling unauthorized data access (CVE-2025-54924, CVE-2025-54925, CVSS 7.5), and two path traversal issues affecting authenticated users (CVE-2025-54926, CVE-2025-54927). The deserialization and path traversal vulnerabilities can result in remote code execution; SSRF variants allow extraction of sensitive data. Affected versions span PME 2022 through 2024 R2, with the optional Advanced Reporting and Dashboards Module in EPO 2022 also impacted when installed alongside vulnerable PME instances.
Several vulnerabilities require authentication or admin privileges, but CVE-2025-54924 and CVE-2025-54925 (SSRF) are remotely exploitable with no authentication required. Schneider Electric has released hotfixes for 2024 R2 (Hotfix_279338), 2023/2023 R2 (Hotfix_199767 and Hotfix_273686_release.12.0), and recommends upgrades for other versions. PME 2022 is end-of-life and no longer supported. CISA reports no active exploitation at the time of this advisory update (November 18, 2025). Organizations should immediately prioritize upgrading or applying patches, particularly for systems exposed to untrusted networks.
Mentioned in this report
Detection guidance
IIS Worker Process Spawning Command Shell or LOLBin
w3wp.exe spawning cmd, PowerShell or common download/execution LOLBins, a typical sign of RCE after exploiting a web-facing app such as an IIS-hosted EcoStruxure PME via deserialization or path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Spawning Command Shell or LOLBin
description: Detects the IIS worker process (w3wp.exe) spawning shells or common living-off-the-land
binaries. EcoStruxure Power Monitoring Expert is hosted on IIS, and successful deserialization
or path traversal RCE would show up as web-server-spawned child processes. Matches
the parent/child relation, not any specific payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Legitimate IIS-hosted applications that shell out to cmd.exe or PowerShell for maintenance
or reporting tasks
- Web-based administration or deployment tools run under IIS application pools
level: medium
id: 91b6ebe4-b167-5a84-8a3a-74e5680bc054
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-03
Web Request with Path Traversal Sequences in URI
Web server requests containing plain or encoded directory traversal sequences, matching the path traversal class of flaws (for example CVE-2025-54926/54927) used to read local files or reach RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Request with Path Traversal Sequences in URI
description: Detects HTTP requests whose URI path or query contains plain, URL-encoded
or double-encoded directory traversal sequences. Generalises on the traversal technique
used against public-facing apps (such as EcoStruxure web components) to enumerate
or read local files; it is not tied to a specific endpoint.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
- attack.collection
- attack.t1005
logsource:
category: webserver
detection:
selection_stem:
cs-uri-stem|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e%5c'
- ..%2f
- ..%5c
- '%252e%252e'
selection_query:
cs-uri-query|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e%5c'
- ..%2f
- ..%5c
- '%252e%252e'
condition: 1 of selection_*
falsepositives:
- Vulnerability scanners run by the security team against internal web servers
- Applications that pass relative file paths as URL parameters
level: medium
id: 7daa3c92-28a1-5018-b9e0-ff6eed177c1b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-03
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs