# Schneider Electric EcoStruxure vulnerabilities enable RCE and data access

Published: 2025-11-18 · Severity: routine · Sectors: energy, manufacturing, infrastructure
Canonical: https://vorant.io/reports/a4e5792c-e210-5995-b617-08925f93a14f/schneider-electric-ecostruxure-vulnerabilities-enable-rce-and-data-access

> Five vulnerabilities in Schneider Electric power management software allow remote code execution and data exfiltration; no active exploitation reported.

Schneider Electric has released a CISA advisory addressing five vulnerabilities across EcoStruxure Power Monitoring Expert (PME), Power Operation (EPO), and Power SCADA Operation (PSO) products. The vulnerabilities include deserialization of untrusted data (CVE-2025-54923, CVSS 8.8), two server-side request forgery (SSRF) flaws enabling unauthorized data access (CVE-2025-54924, CVE-2025-54925, CVSS 7.5), and two path traversal issues affecting authenticated users (CVE-2025-54926, CVE-2025-54927). The deserialization and path traversal vulnerabilities can result in remote code execution; SSRF variants allow extraction of sensitive data. Affected versions span PME 2022 through 2024 R2, with the optional Advanced Reporting and Dashboards Module in EPO 2022 also impacted when installed alongside vulnerable PME instances.

Several vulnerabilities require authentication or admin privileges, but CVE-2025-54924 and CVE-2025-54925 (SSRF) are remotely exploitable with no authentication required. Schneider Electric has released hotfixes for 2024 R2 (Hotfix_279338), 2023/2023 R2 (Hotfix_199767 and Hotfix_273686_release.12.0), and recommends upgrades for other versions. PME 2022 is end-of-life and no longer supported. CISA reports no active exploitation at the time of this advisory update (November 18, 2025). Organizations should immediately prioritize upgrading or applying patches, particularly for systems exposed to untrusted networks.

## Mentioned in this report

- Vulnerabilities: CVE-2025-54923, CVE-2025-54924, CVE-2025-54925, CVE-2025-54926, CVE-2025-54927

## Detection guidance (public sample)

### IIS Worker Process Spawning Command Shell or LOLBin

ATT&CK: T1190

w3wp.exe spawning cmd, PowerShell or common download/execution LOLBins, a typical sign of RCE after exploiting a web-facing app such as an IIS-hosted EcoStruxure PME via deserialization or path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Command Shell or LOLBin
description: Detects the IIS worker process (w3wp.exe) spawning shells or common living-off-the-land
  binaries. EcoStruxure Power Monitoring Expert is hosted on IIS, and successful deserialization
  or path traversal RCE would show up as web-server-spawned child processes. Matches
  the parent/child relation, not any specific payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- Legitimate IIS-hosted applications that shell out to cmd.exe or PowerShell for maintenance
  or reporting tasks
- Web-based administration or deployment tools run under IIS application pools
level: medium
id: 91b6ebe4-b167-5a84-8a3a-74e5680bc054
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-03
```

### Web Request with Path Traversal Sequences in URI

ATT&CK: T1083

Web server requests containing plain or encoded directory traversal sequences, matching the path traversal class of flaws (for example CVE-2025-54926/54927) used to read local files or reach RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Request with Path Traversal Sequences in URI
description: Detects HTTP requests whose URI path or query contains plain, URL-encoded
  or double-encoded directory traversal sequences. Generalises on the traversal technique
  used against public-facing apps (such as EcoStruxure web components) to enumerate
  or read local files; it is not tied to a specific endpoint.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
- attack.collection
- attack.t1005
logsource:
  category: webserver
detection:
  selection_stem:
    cs-uri-stem|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e%5c'
    - ..%2f
    - ..%5c
    - '%252e%252e'
  selection_query:
    cs-uri-query|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e%5c'
    - ..%2f
    - ..%5c
    - '%252e%252e'
  condition: 1 of selection_*
falsepositives:
- Vulnerability scanners run by the security team against internal web servers
- Applications that pass relative file paths as URL parameters
level: medium
id: 7daa3c92-28a1-5018-b9e0-ff6eed177c1b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a4e5792c-e210-5995-b617-08925f93a14f/schneider-electric-ecostruxure-vulnerabilities-enable-rce-and-data-access.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup