Schneider ELectric

Products

ProductCVEsExploitedLatest
StruxureWare Data Center Expert15–Jul 12, 2023
EcoStruxure Control Expert12–Feb 14, 2024
Modicon M340 CPU (part numbers BMXP34*)12–Nov 13, 2024
PowerChute Serial Shutdown12–Sep 1, 2026
EcoStruxure Process Expert10–Jan 29, 2026
IGSS Data Server (IGSSdataServer.exe)10–Feb 1, 2023
EcoStruxure Power Monitoring Expert (PME)9–Mar 10, 2026
IGSS Dashboard (DashBoard.exe)9–Jun 14, 2023
Custom Reports (RMS16.dll)8–Mar 21, 2023
IGSS Data Server(IGSSdataServer.exe)8–Mar 21, 2023
Pro-face BLUE7–Jun 14, 2023
OPC UA Modicon Communication Module7–Jul 13, 2022
Modicon Momentum Unity M1E Processor (171CBU*)7–Nov 13, 2024
Modicon Controllers M241/M2517–Mar 10, 2026
EcoStruxure™ IT Data Center Expert7–Jun 9, 2026
Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)7–Jan 17, 2025
X80 advanced RTU Communication Module7–Jul 13, 2022
EcoStruxure Operator Terminal Expert7–Jun 14, 2023
Sage 24006–Jun 12, 2024
Data Center Expert6–Oct 11, 2024
Sage 14506–Jun 12, 2024
Modicon M580 CPU (part numbers BMEP* and BMEH*)6–Apr 19, 2023
Sage 44006–Jun 12, 2024
Sage 14106–Jun 12, 2024
Wiser Smart6–Jun 2, 2022
Sage 14306–Jun 12, 2024
EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module6–Mar 10, 2026
Sage 3030 Magnum6–Jun 12, 2024
Modicon MC80 (BMKC80)5–Apr 19, 2023
Modicon Controllers M258 / LMC0585–Jun 10, 2025
Schneider Electric Easy UPS Online Monitoring Software4–Feb 1, 2023
EVLink WallBox4–Jun 10, 2025
APC Easy UPS Online Monitoring Software4–Feb 1, 2023
ASCO 5350 Eight Channel Remote Annunciator4–Feb 13, 2025
ASCO 5310 Single-Channel Remote Annunciator4–Feb 13, 2025
Easergy P54–Jul 13, 2022
EcoStruxure Power Commission4–Feb 1, 2023
Modicon MC80 (part numbers BMKC80)4–Nov 13, 2024
EcoStruxure Foxboro DCS Core Control Services3–Jul 11, 2024
Saitel DR RTU3–Sep 9, 2025
Saitel DP Remote Terminal Unit & Controller3–Jun 25, 2026
Easergy Studio3–Oct 11, 2024
Enerlin’X eIFE (LV851001)3–Feb 13, 2025
C-Bus Toolkit3–Oct 4, 2023
EcoStruxure Power Monitoring Expert3–Jul 11, 2025
EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)3–Sep 9, 2026
NetBotz 4 - 355/450/455/550/5703–Apr 18, 2023
Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)3–Apr 18, 2023
Trio Q Licensed Data Radio3–Apr 9, 2025
APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)3–Apr 18, 2023
Easergy T200 (Modbus) Models: T200I, T200E, T200P, T200S, T200H 3–Mar 18, 2024
SmartConnect3–Mar 9, 2022
Easergy T200 (DNP3) Models: T200I, T200E, T200P, T200S, T200H3–Mar 18, 2024
PowerLogic HDPM60003–Jan 17, 2025
Modicon Controllers M2623–Jun 10, 2025
PowerLogic™ P73–Jun 25, 2026
Easergy T200 (IEC104) Models: T200I, T200E, T200P, T200S, T200H3–Mar 18, 2024
EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller3–Jun 25, 2026
EcoStruxure Power Build Rapsody3–Jan 15, 2026
Saitel DP RTU3–Sep 9, 2025
Enerlin’X IFE interface (LV434001)3–Feb 13, 2025
Conext™ ComBox3–Jan 30, 2023
Modicon Controllers M241 / M2513–May 14, 2025
ION8800 2–Nov 15, 2023
Wiser for C-Bus Automation Controller, LSS5500SHAC2–Jan 30, 2023
SCADAPack 47xi2–Sep 11, 2026
EVlink Home Smart2–Oct 13, 2024
Accutech Manager2–Aug 20, 2024
EcoStruxure OPC UA Server Expert2–Sep 1, 2026
ION86502–Nov 15, 2023
SpaceLogic AS-P2–Jun 12, 2024
EcoStruxure Foxboro DCS Control Core Services2–Jun 14, 2023
EcoStruxure IT Gateway2–Nov 13, 2024
EcoStruxure Panel Server2–May 12, 2026
SpaceLogic C-Bus Application Controller, 5500AC22–Jan 30, 2023
NetBotz 5 - 750/7552–Sep 1, 2026
Zelio Soft 22–Oct 8, 2024
EcoStruxure Power Operation (EPO) – Advanced Reporting and Dashboards Module2–Nov 15, 2023
Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety)2–Jan 17, 2025
SCADAPack 57x2–Sep 11, 2026
SpaceLogic AS-B2–Jun 12, 2024
Trio Q-Series Ethernet Data Radio2–Dec 14, 2023
EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA)2–Jan 31, 2023
SCADAPack 47x2–Sep 11, 2026
Clipsal C-Bus Network Automation Controller, 5500NAC2–Jan 30, 2023
EcoStruxure Process Expert for AVEVA System Platform2–Jan 29, 2026
EcoStruxure Enterprise Server2–Aug 20, 2025
PowerLogic T3002–Sep 9, 2026
Modicon M3402–Aug 18, 2025
Legacy Modicon Premium CPUs (TSXP57*)2–Apr 19, 2023
Clipsal Wiser for C-Bus Automation Controller, 5500SHAC2–Jan 30, 2023
Legacy Modicon Quantum (140CPU65*)2–Apr 19, 2023
C-Bus Network Automation Controller, LSS5500NAC2–Jan 30, 2023
EcoStruxure Building Operation Workstation2–Feb 11, 2026
EcoStruxure Building Operation Webstation2–Feb 11, 2026
ConneXium Network Manager2–Apr 9, 2025
EcoStruxure™ Cybersecurity Admin Expert (CAE)2–Jan 30, 2023
EcoStruxure Power SCADA Operation (PSO) - Advanced Reporting and Dashboards Module2–Nov 15, 2023
Trio J-Series Ethernet Data Radio2–Dec 14, 2023
Trio E-Series Ethernet Data Radio2–Dec 14, 2023
SpaceLogic C-Bus Network Automation Controller, 5500NAC22–Jan 30, 2023
CanBRASS1–Jan 30, 2023
VW3A3530D: ATVdPAC module1–Sep 9, 2025
Pro-face Remote HMI1–Jan 17, 2025
EcoStruxure Power Automation System User Interface (EPAS-UI) - Secured Versions1–Mar 12, 2025
Easergy MiCOM P342, P343, P344, P3451–Apr 14, 2026
Easergy MiCOM P14x1–Apr 14, 2026
Easergy MiCOM P301–May 12, 2026
SCADAPack Workbench1–Mar 28, 2022
Uni-Telway driver1–Feb 13, 2025
ATV6000 Medium Voltage Altivar Process Drives1–Sep 9, 2025
Modicon Controllers M258/LMC0581–Mar 10, 2026
Sage RTU 44001–Oct 13, 2026
BMXNOE0110: Modbus/TCP Ethernet Modicon M340 FactoryCast module1–Aug 18, 2025
Easergy MiCOM P24x1–Apr 14, 2026
VW3A3720 & VW3A3721 Altivar Process Communication Modules1–Sep 9, 2025
EcoStruxure Geo SCADA Expert 20191–Feb 24, 2023
EcoStruxure™ Cybersecurity Admin Expert1–Jul 29, 2026
EVLink Pro AC1–Jan 17, 2025
SCADAPack 470R1–Sep 11, 2026
Merten Jalousie-/Schaltaktor REG-K/8x/16x/10 m. HB 6499081–Apr 18, 2023
OPC Factory Server (OFS)1–May 16, 2023
EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module1–Jan 28, 2025
Easergy C51–May 12, 2026
Sage RTU 24001–Oct 13, 2026
Merten KNX Uni-Dimmaktor LL REG-K/2x230/300 W MEG6710-00021–Apr 18, 2023
Merten KNX ARGUS 180/2,20M UP SYSTEM 6317251–Apr 18, 2023
PowerLogic PM53411–Nov 13, 2024
Acti9 PowerTag Link C1–Jul 13, 2022
EcoStruxure™ Power Automation System Gateway (EPAS-GTW)1–May 12, 2026
Modicon Momentum MDI (171CBU*)1–Nov 22, 2022
PowerLogic ION74001–May 22, 2023
Galaxy VS1–Nov 15, 2023
EcoStruxure™ Automation Expert1–Mar 10, 2026
EcoStruxure™ Modicon Communication Server1–Sep 1, 2026
Uni-Telway driver used in EcoStruxure Process Expert1–Feb 13, 2025
EcoStruxure™ Power Automation System User Interface (EPAS-UI)1–May 12, 2026
PowerLogic™ P7 Protection and Control Platform1–May 12, 2026
BMXNOC0401: Modicon M340 X80 Ethernet Communication modules1–Aug 18, 2025
ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives1–Sep 9, 2025
Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime1–Dec 17, 2024
EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module1–Jan 28, 2025
Uni-Telway driver used in EcoStruxure Control Expert1–Feb 13, 2025
System Monitor application in Harmony Industrial PC HMIBMO/HMIBMI/HMIPSO/HMIBMP/HMIBMU/HMIPSP/HMIPEP series1–Oct 8, 2024
PowerLogic ION90001–May 22, 2023
InsightFacility1–Apr 18, 2023
Easergy MiCOM P8411–Apr 14, 2026
ATS490 Altivar Soft Starter1–Sep 9, 2025
EcoStruxure Machine Expert – HVAC1–Jan 30, 2023
PowerLogic ION86501–May 22, 2023
PowerLogic P51–Jun 12, 2024
Easergy MiCOM P442, P4441–Apr 14, 2026
EcoStruxure Power Operation (EPO) 20221–Jan 28, 2025
Pro-face GP-Pro EX1–Jan 17, 2025
Legacy Modicon Quantum/Premium1–Nov 22, 2022
PowerLogic PM80001–May 22, 2023
EcoStruxure™ Power Operation Advanced Reporting and Dashboards Module1–Jul 11, 2025
Modicon M340 CPUs1–Nov 22, 2022
SESU1–Aug 18, 2025
BMXNGD0100: M580 Global Data module1–Aug 18, 2025
EcoStruxure™ Foxboro DCS1–Mar 10, 2026
SCADAPack RemoteConnect for x701–Mar 28, 2022
Easergy MiCOM P642, P6451–Apr 14, 2026
Wiser Home Controller WHC-5918A1–Jul 11, 2024
Modicon M580 CPU1–Sep 12, 2022
Modicon Momentum CPU (171CBU*)1–Feb 1, 2023
Power Logic ION Setup1–Jun 2, 2022
Merten INSTABUS Tastermodul 2fach System M 6252991–Apr 18, 2023
Sage RTU 14301–Oct 13, 2026
PowerLogic™ T5001–May 12, 2026
Merten INSTABUS Tastermodul 1fach System M 6251991–Apr 18, 2023
Ecostruxure™ Machine Expert HVAC1–May 14, 2026
Easergy MiCOM P3411–Apr 14, 2026
Legacy ION products1–May 22, 2023
Merten KNX Schaltakt.2x6A UP m.2 Eing. MEG6003-00021–Apr 18, 2023
Easy UPS Online Monitoring Software1–Dec 14, 2023
Uni-Telway driver used in EcoStruxure Process Expert for AVEVA System Platform1–Feb 13, 2025
Modicon M340 X80 Ethernet Communication modules: BMXNOE0100 (H) BMXNOE0110 (H) BMXNOR0200H RTU1–Nov 22, 2022
PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series with Pro-face BLUE runtime1–Dec 17, 2024
EcoStruxure Geo SCADA Expert 20211–Feb 24, 2023
WebHMI – Deployed with EcoStruxure Power Automation System1–Mar 12, 2025
Vijeo Designer1–Sep 11, 2024
BMXNOR0200H: Ethernet / Serial RTU Module1–Aug 18, 2025
BMENOR2200H1–Jan 17, 2025
ATV340E Altivar Machine Drives1–Sep 9, 2025
EasyLogic T150 (formerly Saitel DR)1–May 12, 2026
RemoteConnect1–Jul 29, 2026
PowerLogic PM53401–Nov 13, 2024
Modicon M340 CPU1–Sep 12, 2022
Modicon M2621–Mar 10, 2026
Easergy MiCOM P443, P445, P446, P543, P544, P545, P5461–Apr 14, 2026
Easergy MiCOM P7461–Apr 14, 2026
Harmony Timer Relay RENF22R2MMW1–Feb 14, 2024
Uni-Telway driver used in OPC Factory Server1–Feb 13, 2025
Web Designer for BMXNOE0110(H)1–Jan 17, 2025
Modicon M5801–Sep 11, 2026
EcoStruxure Power Monitoring Expert (PME) 20201–Jan 28, 2025
iPMFLS1–May 12, 2026
Network module, Modicon M340, Ethernet TCP/IP BMXNOE01101–Jun 12, 2024
FoxRTU Station1–Jul 11, 2024

Exploited and recent CVEs

  • CVE-2026-102250 High 8.6 CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which co 0.2%
  • CVE-2026-102250 High 8.6 CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which co 0.2%
  • CVE-2026-102250 High 8.6 CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which co 0.2%
  • CVE-2026-102250 High 8.6 CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which co 0.2%
  • CVE-2026-102250 High 8.6 CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which co 0.2%
  • CVE-2026-102250 High 8.6 CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which co 0.2%
  • CVE-2026-3869 Critical 9.2 CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with 0.5%
  • CVE-2026-3869 Critical 9.2 CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with 0.5%
  • CVE-2026-81861 Medium 5.9 CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality. 0.5%
  • CVE-2026-81861 Medium 5.9 CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality. 0.5%
  • CVE-2026-81861 Medium 5.9 CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality. 0.5%
  • CVE-2026-81861 Medium 5.9 CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality. 0.5%
  • CVE-2026-81861 Medium 5.9 CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality. 0.5%
  • CVE-2026-81861 Medium 5.9 CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality. 0.5%
  • CVE-2026-81861 Medium 5.9 CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality. 0.5%
  • CVE-2026-77120 High 8.7 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and unauthorized execution of admi 0.7%
  • CVE-2026-19233 High 8.6 CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, 0.6%
  • CVE-2026-8044 High 8.6 CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when mal 0.7%
  • CVE-2026-13348 Medium 6.9 CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of 0.5%
  • CVE-2026-13337 Medium 5.1 CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-serv 0.3%
  • CVE-2026-13336 High 7.3 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back 1.6%
  • CVE-2024-10085 High 8.2 CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are se 0.4%
  • CVE-2024-10085 High 8.2 CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are se 0.4%
  • CVE-2026-12927 High 8.4 CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is imported to IGSS Definition. 0.2%
  • CVE-2026-0667 Critical 9.3 CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over 0.5%
  • CVE-2026-0667 Critical 9.3 CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over 0.5%
  • CVE-2026-0667 Critical 9.3 CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over 0.5%
  • CVE-2026-0667 Critical 9.3 CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over 0.5%
  • CVE-2026-14354 High 8.7 CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially leading to compromise of managed devices, 0.2%
  • CVE-2026-9718 Medium 6.9 CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a specially crafted request is 0.4%