Schneider Electric HVAC software stores source code in cleartext
Schneider Electric patched a cleartext storage flaw in EcoStruxure Machine Expert HVAC that exposes protected source code to authorized attackers.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Schneider Electric disclosed CVE-2026-6332, a cleartext storage vulnerability (CWE-312) in EcoStruxure Machine Expert HVAC, a programming platform for Modicon M171/M172 logic controllers used in industrial environments. The flaw allows an authorized attacker with access to source code during editing or compilation to extract sensitive information, including protected intellectual property, resulting in loss of confidentiality. All versions prior to 1.10.0 are affected.
The vulnerability was reported by Schneider Electric's own CPCERT team to CISA. While the issue requires existing authorized access, the exposure of proprietary controller logic poses risks to facilities across chemical, critical manufacturing, energy, and water sectors worldwide. Schneider Electric released version 1.10.0 to remediate the issue.
No evidence of active exploitation is mentioned in the advisory. Organizations using affected versions should upgrade to 1.10.0 immediately and follow defense-in-depth practices, including network segmentation, physical access controls for programming terminals, and restricting programming software to isolated networks.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-07
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs