# cve.now: Schneider Electric

The newest entries naming Schneider Electric as an affected vendor (up to 200), of 433 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-102250](https://cve.now/CVE-2026-102250.md): CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an autho (CVSS 8.6)
- [CVE-2026-3869](https://cve.now/CVE-2026-3869.md): CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and (CVSS 9.2)
- [CVE-2026-81861](https://cve.now/CVE-2026-81861.md): CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized acc (CVSS 5.9)
- [CVE-2026-77120](https://cve.now/CVE-2026-77120.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause pri (CVSS 8.7)
- [CVE-2026-19233](https://cve.now/CVE-2026-19233.md): CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server da (CVSS 8.6)
- [CVE-2026-8044](https://cve.now/CVE-2026-8044.md): CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code (CVSS 8.6)
- [CVE-2026-13348](https://cve.now/CVE-2026-13348.md): CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized ac (CVSS 6.9)
- [CVE-2026-13337](https://cve.now/CVE-2026-13337.md): CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when (CVSS 5.1)
- [CVE-2026-13336](https://cve.now/CVE-2026-13336.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause exe (CVSS 7.3)
- [CVE-2024-10085](https://cve.now/CVE-2024-10085.md): CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communic (CVSS 8.2)
- [CVE-2026-12927](https://cve.now/CVE-2026-12927.md): CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious (CVSS 8.4)
- [CVE-2026-0667](https://cve.now/CVE-2026-0667.md): CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and (CVSS 9.3)
- [CVE-2026-14354](https://cve.now/CVE-2026-14354.md): CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modific (CVSS 8.7)
- [CVE-2026-9718](https://cve.now/CVE-2026-9718.md): CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impact (CVSS 6.9)
- [CVE-2026-9717](https://cve.now/CVE-2026-9717.md): CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized (CVSS 8.6)
- [CVE-2026-9716](https://cve.now/CVE-2026-9716.md): CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configu (CVSS 8.7)
- [CVE-2026-9651](https://cve.now/CVE-2026-9651.md): CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and (CVSS 6.7)
- [CVE-2026-9650](https://cve.now/CVE-2026-9650.md): CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when u (CVSS 8.7)
- [CVE-2026-8045](https://cve.now/CVE-2026-8045.md): CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side fi (CVSS 7.1)
- [CVE-2026-6332](https://cve.now/CVE-2026-6332.md): Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC (CVSS 6.8)
- [CVE-2026-6866](https://cve.now/CVE-2026-6866.md): Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server (CVSS 8.2)
- [CVE-2026-6865](https://cve.now/CVE-2026-6865.md): Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Products (CVSS 7.1)
- [CVE-2026-4827](https://cve.now/CVE-2026-4827.md): Insufficient Entropy vulnerability on Multiple Products (CVSS 8.7)
- [CVE-2026-2401](https://cve.now/CVE-2026-2401.md): CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when (CVSS 2.4)
- [CVE-2026-2400](https://cve.now/CVE-2026-2400.md): CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to re (CVSS 5.3)
- [CVE-2026-2403](https://cve.now/CVE-2026-2403.md): CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting lo (CVSS 5.3)
- [CVE-2026-2405](https://cve.now/CVE-2026-2405.md): CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of se (CVSS 5.3)
- [CVE-2026-2402](https://cve.now/CVE-2026-2402.md): CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the us (CVSS 6.9)
- [CVE-2026-2404](https://cve.now/CVE-2026-2404.md): CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters t (CVSS 6.9)
- [CVE-2026-2399](https://cve.now/CVE-2026-2399.md): CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files o (CVSS 6.9)
- [CVE-2026-4832](https://cve.now/CVE-2026-4832.md): CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unau (CVSS 6.9)
- [CVE-2026-2273](https://cve.now/CVE-2026-2273.md): CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on th (CVSS 7.2)
- [CVE-2026-1286](https://cve.now/CVE-2026-1286.md): CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote c (CVSS 7.0)
- [CVE-2025-13902](https://cve.now/CVE-2025-13902.md): CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition (CVSS 5.1)
- [CVE-2025-13901](https://cve.now/CVE-2025-13901.md): CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol whe (CVSS 6.9)
- [CVE-2025-11739](https://cve.now/CVE-2025-11739.md): CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges whe (CVSS 8.5)
- [CVE-2025-13957](https://cve.now/CVE-2025-13957.md): CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Pro (CVSS 7.5)
- [CVE-2026-1226](https://cve.now/CVE-2026-1226.md): CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the ap (CVSS 7.0)
- [CVE-2026-1227](https://cve.now/CVE-2026-1227.md): CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, (CVSS 7.0)
- [CVE-2025-13905](https://cve.now/CVE-2025-13905.md): CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or mo (CVSS 7.0)
- [CVE-2025-13845](https://cve.now/CVE-2025-13845.md): CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) (CVSS 8.4)
- [CVE-2025-13844](https://cve.now/CVE-2025-13844.md): CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD fi (CVSS 8.4)
- [CVE-2025-11567](https://cve.now/CVE-2025-11567.md): CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is n (CVSS 7.3)
- [CVE-2025-11566](https://cve.now/CVE-2025-11566.md): CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to (CVSS 6.9)
- [CVE-2025-11565](https://cve.now/CVE-2025-11565.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system (CVSS 7.3)
- [CVE-2025-9997](https://cve.now/CVE-2025-9997.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause com (CVSS 5.8)
- [CVE-2025-9996](https://cve.now/CVE-2025-9996.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the (CVSS 5.8)
- [CVE-2025-7746](https://cve.now/CVE-2025-7746.md): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvali (CVSS 5.3)
- [CVE-2025-8448](https://cve.now/CVE-2025-8448.md): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive c (CVSS 1.0)
- [CVE-2025-8449](https://cve.now/CVE-2025-8449.md): CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a spec (CVSS 4.1)
- [CVE-2025-54927](https://cve.now/CVE-2025-54927.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized ac (CVSS 4.9)
- [CVE-2025-54926](https://cve.now/CVE-2025-54926.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code exe (CVSS 7.2)
- [CVE-2025-54925](https://cve.now/CVE-2025-54925.md): CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker con (CVSS 7.5)
- [CVE-2025-54924](https://cve.now/CVE-2025-54924.md): CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sen (CVSS 7.5)
- [CVE-2025-54923](https://cve.now/CVE-2025-54923.md): CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity wh (CVSS 8.7)
- [CVE-2025-8453](https://cve.now/CVE-2025-8453.md): CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privil (CVSS 8.4)
- [CVE-2025-5296](https://cve.now/CVE-2025-5296.md): CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written t (CVSS 7.0)
- [CVE-2025-6625](https://cve.now/CVE-2025-6625.md): CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the (CVSS 8.7)
- [CVE-2025-6788](https://cve.now/CVE-2025-6788.md): A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, provid (CVSS 5.3)
- [CVE-2025-50124](https://cve.now/CVE-2025-50124.md): A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a pr (CVSS 7.2)
- [CVE-2025-50125](https://cve.now/CVE-2025-50125.md): A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server (CVSS 6.3)
- [CVE-2025-50123](https://cve.now/CVE-2025-50123.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a pri (CVSS 7.2)
- [CVE-2025-50122](https://cve.now/CVE-2025-50122.md): A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reve (CVSS 8.9)
- [CVE-2025-50121](https://cve.now/CVE-2025-50121.md): A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause u (CVSS 9.5)
- [CVE-2025-6438](https://cve.now/CVE-2025-6438.md): A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls (CVSS 5.9)
- [CVE-2025-3117](https://cve.now/CVE-2025-3117.md): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration fi (CVSS 5.1)
- [CVE-2025-3116](https://cve.now/CVE-2025-3116.md): CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special (CVSS 7.1)
- [CVE-2025-3905](https://cve.now/CVE-2025-3905.md): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system varia (CVSS 5.1)
- [CVE-2025-3112](https://cve.now/CVE-2025-3112.md): CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user send (CVSS 7.1)
- [CVE-2025-3899](https://cve.now/CVE-2025-3899.md): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Certificates page on We (CVSS 5.1)
- [CVE-2025-3898](https://cve.now/CVE-2025-3898.md): CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS r (CVSS 7.1)
- [CVE-2025-5743](https://cve.now/CVE-2025-5743.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rem (CVSS 7.0)
- [CVE-2025-5742](https://cve.now/CVE-2025-5742.md): CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated user (CVSS 5.1)
- [CVE-2025-5741](https://cve.now/CVE-2025-5741.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file (CVSS 6.9)
- [CVE-2025-5740](https://cve.now/CVE-2025-5740.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file (CVSS 8.6)
- [CVE-2025-2875](https://cve.now/CVE-2025-2875.md): CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality whe (CVSS 8.7)
- [CVE-2025-3916](https://cve.now/CVE-2025-3916.md): CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially (CVSS 4.6)
- [CVE-2025-2442](https://cve.now/CVE-2025-2442.md): CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access whic (CVSS 5.4)
- [CVE-2025-2441](https://cve.now/CVE-2025-2441.md): CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malic (CVSS 4.1)
- [CVE-2025-2440](https://cve.now/CVE-2025-2440.md): CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential d (CVSS 4.1)
- [CVE-2025-2223](https://cve.now/CVE-2025-2223.md): CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering (CVSS 8.4)
- [CVE-2025-2222](https://cve.now/CVE-2025-2222.md): CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privi (CVSS 8.2)
- [CVE-2025-1960](https://cve.now/CVE-2025-1960.md): CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized co (CVSS 9.8)
- [CVE-2025-0813](https://cve.now/CVE-2025-0813.md): CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission (CVSS 7.0)
- [CVE-2025-2002](https://cve.now/CVE-2025-2002.md): CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials wh (CVSS 4.0)
- [CVE-2025-0814](https://cve.now/CVE-2025-0814.md): CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product whe (CVSS 6.9)
- [CVE-2025-0815](https://cve.now/CVE-2025-0815.md): CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious ICMPV6 packets are s (CVSS 7.1)
- [CVE-2025-0816](https://cve.now/CVE-2025-0816.md): CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sen (CVSS 7.1)
- [CVE-2025-0327](https://cve.now/CVE-2025-0327.md): CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as (CVSS 8.5)
- [CVE-2025-1070](https://cve.now/CVE-2025-1070.md): CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file (CVSS 7.2)
- [CVE-2025-1060](https://cve.now/CVE-2025-1060.md): CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic (CVSS 8.7)
- [CVE-2025-1059](https://cve.now/CVE-2025-1059.md): CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious pa (CVSS 8.7)
- [CVE-2025-1058](https://cve.now/CVE-2025-1058.md): CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is do (CVSS 7.2)
- [CVE-2024-10083](https://cve.now/CVE-2024-10083.md): CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation when specific driver in (CVSS 6.8)
- [CVE-2024-8401](https://cve.now/CVE-2024-8401.md): CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated atta (CVSS 5.4)
- [CVE-2024-10498](https://cve.now/CVE-2024-10498.md): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow an unauthorized attac (CVSS 6.9)
- [CVE-2024-10497](https://cve.now/CVE-2024-10497.md): CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outs (CVSS 8.7)
- [CVE-2024-12703](https://cve.now/CVE-2024-12703.md): CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote c (CVSS 8.5)
- [CVE-2024-12142](https://cve.now/CVE-2024-12142.md): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restrict (CVSS 8.8)
- [CVE-2024-12476](https://cve.now/CVE-2024-12476.md): CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts worksta (CVSS 8.4)
- [CVE-2024-12399](https://cve.now/CVE-2024-12399.md): CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause part (CVSS 6.1)
- [CVE-2024-11425](https://cve.now/CVE-2024-11425.md): CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticated (CVSS 8.7)
- [CVE-2024-11139](https://cve.now/CVE-2024-11139.md): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to ex (CVSS 4.6)
- [CVE-2024-11999](https://cve.now/CVE-2024-11999.md): CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authentica (CVSS 8.7)
- [CVE-2024-11737](https://cve.now/CVE-2024-11737.md): CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of th (CVSS 9.3)
- [CVE-2024-10511](https://cve.now/CVE-2024-10511.md): CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwo (CVSS 6.3)
- [CVE-2024-10575](https://cve.now/CVE-2024-10575.md): CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacti (CVSS 10.0)
- [CVE-2024-9409](https://cve.now/CVE-2024-9409.md): CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communica (CVSS 8.7)
- [CVE-2024-8936](https://cve.now/CVE-2024-8936.md): CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Ma (CVSS 8.3)
- [CVE-2024-8938](https://cve.now/CVE-2024-8938.md): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary (CVSS 9.2)
- [CVE-2024-8937](https://cve.now/CVE-2024-8937.md): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary (CVSS 8.3)
- [CVE-2024-8935](https://cve.now/CVE-2024-8935.md): CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integri (CVSS 7.7)
- [CVE-2024-8933](https://cve.now/CVE-2024-8933.md): CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retr (CVSS 7.5)
- [CVE-2024-8070](https://cve.now/CVE-2024-8070.md): CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binary (CVSS 8.5)
- [CVE-2024-8530](https://cve.now/CVE-2024-8530.md): CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generat (CVSS 5.9)
- [CVE-2024-8531](https://cve.now/CVE-2024-8531.md): CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an (CVSS 7.2)
- [CVE-2024-9002](https://cve.now/CVE-2024-9002.md): CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and av (CVSS 7.8)
- [CVE-2024-8884](https://cve.now/CVE-2024-8884.md): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause exposure of credentials when attac (CVSS 9.8)
- [CVE-2024-9005](https://cve.now/CVE-2024-9005.md): CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely de (CVSS 7.3)
- [CVE-2024-8518](https://cve.now/CVE-2024-8518.md): CWE-20: Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft 2 application when a specially crafted pro (CVSS 3.3)
- [CVE-2024-8422](https://cve.now/CVE-2024-8422.md): CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & inte (CVSS 7.8)
- [CVE-2024-8306](https://cve.now/CVE-2024-8306.md): CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity and ava (CVSS 7.8)
- [CVE-2024-6918](https://cve.now/CVE-2024-6918.md): CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutec (CVSS 7.5)
- [CVE-2024-6407](https://cve.now/CVE-2024-6407.md): CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to th (CVSS 9.8)
- [CVE-2024-6528](https://cve.now/CVE-2024-6528.md): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnera (CVSS 5.4)
- [CVE-2024-2602](https://cve.now/CVE-2024-2602.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code (CVSS 7.3)
- [CVE-2024-5681](https://cve.now/CVE-2024-5681.md): CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kerne (CVSS 7.8)
- [CVE-2024-5680](https://cve.now/CVE-2024-5680.md): CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local (CVSS 7.1)
- [CVE-2024-5679](https://cve.now/CVE-2024-5679.md): CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor wit (CVSS 7.1)
- [CVE-2024-0865](https://cve.now/CVE-2024-0865.md): CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrati (CVSS 7.8)
- [CVE-2024-5559](https://cve.now/CVE-2024-5559.md): CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an atta (CVSS 6.1)
- [CVE-2024-2747](https://cve.now/CVE-2024-2747.md): CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user re (CVSS 7.8)
- [CVE-2024-37040](https://cve.now/CVE-2024-37040.md): CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to (CVSS 5.4)
- [CVE-2024-37039](https://cve.now/CVE-2024-37039.md): CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially cra (CVSS 5.9)
- [CVE-2024-37038](https://cve.now/CVE-2024-37038.md): CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface (CVSS 7.5)
- [CVE-2024-37037](https://cve.now/CVE-2024-37037.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticate (CVSS 8.1)
- [CVE-2024-37036](https://cve.now/CVE-2024-37036.md): CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and pa (CVSS 9.8)
- [CVE-2024-5560](https://cve.now/CVE-2024-5560.md): CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a s (CVSS 5.3)
- [CVE-2024-5557](https://cve.now/CVE-2024-5557.md): CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacke (CVSS 4.5)
- [CVE-2024-5558](https://cve.now/CVE-2024-5558.md): CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker a (CVSS 6.4)
- [CVE-2024-5313](https://cve.now/CVE-2024-5313.md): CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. (CVSS 6.5)
- [CVE-2024-5056](https://cve.now/CVE-2024-5056.md): CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and p (CVSS 6.5)
- [CVE-2024-2229](https://cve.now/CVE-2024-2229.md): CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loa (CVSS 7.8)
- [CVE-2024-2052](https://cve.now/CVE-2024-2052.md): CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltrat (CVSS 7.5)
- [CVE-2024-2050](https://cve.now/CVE-2024-2050.md): CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an attacker injects (CVSS 8.2)
- [CVE-2024-2051](https://cve.now/CVE-2024-2051.md): CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized (CVSS 9.8)
- [CVE-2024-0568](https://cve.now/CVE-2024-0568.md): CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering of device configuration over NFC communicatio (CVSS 8.8)
- [CVE-2023-27975](https://cve.now/CVE-2023-27975.md): CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized access to the project file in EcoStruxure (CVSS 7.1)
- [CVE-2023-6408](https://cve.now/CVE-2023-6408.md): CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a d (CVSS 8.1)
- [CVE-2023-6409](https://cve.now/CVE-2023-6409.md): CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with applicati (CVSS 7.7)
- [CVE-2023-7032](https://cve.now/CVE-2023-7032.md): A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain (CVSS 7.8)
- [CVE-2023-6407](https://cve.now/CVE-2023-6407.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary fi (CVSS 5.3)
- [CVE-2023-5630](https://cve.now/CVE-2023-5630.md): A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmw (CVSS 6.5)
- [CVE-2023-5629](https://cve.now/CVE-2023-5629.md): A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phish (CVSS 8.2)
- [CVE-2023-6032](https://cve.now/CVE-2023-6032.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file syste (CVSS 5.3)
- [CVE-2023-5987](https://cve.now/CVE-2023-5987.md): A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability (CVSS 6.1)
- [CVE-2023-5986](https://cve.now/CVE-2023-5986.md): A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scr (CVSS 8.2)
- [CVE-2023-5985](https://cve.now/CVE-2023-5985.md): A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that could cause compromise of a user’s browser (CVSS 4.8)
- [CVE-2023-5984](https://cve.now/CVE-2023-5984.md): A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorize (CVSS 7.2)
- [CVE-2023-5391](https://cve.now/CVE-2023-5391.md): A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted (CVSS 9.8)
- [CVE-2023-5399](https://cve.now/CVE-2023-5399.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tamperin (CVSS 9.8)
- [CVE-2023-5402](https://cve.now/CVE-2023-5402.md): A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used (CVSS 9.8)
- [CVE-2023-4516](https://cve.now/CVE-2023-4516.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker t (CVSS 7.8)
- [CVE-2023-3953](https://cve.now/CVE-2023-3953.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption (CVSS 5.3)
- [CVE-2023-29414](https://cve.now/CVE-2023-29414.md): A CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) vulnerability exists that could cause user privilege escala (CVSS 7.8)
- [CVE-2023-37200](https://cve.now/CVE-2023-37200.md): A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replaci (CVSS 5.5)
- [CVE-2023-37199](https://cve.now/CVE-2023-37199.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an adm (CVSS 6.8)
- [CVE-2023-37198](https://cve.now/CVE-2023-37198.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an (CVSS 6.8)
- [CVE-2023-37197](https://cve.now/CVE-2023-37197.md): A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that co (CVSS 8.8)
- [CVE-2023-37196](https://cve.now/CVE-2023-37196.md): A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that coul (CVSS 8.8)
- [CVE-2023-2570](https://cve.now/CVE-2023-2570.md): A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potentially kernel execu (CVSS 7.0)
- [CVE-2023-2569](https://cve.now/CVE-2023-2569.md): A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, and potentially kerne (CVSS 7.8)
- [CVE-2023-3001](https://cve.now/CVE-2023-3001.md): A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious p (CVSS 7.8)
- [CVE-2023-1049](https://cve.now/CVE-2023-1049.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when (CVSS 7.8)
- [CVE-2022-46680](https://cve.now/CVE-2022-46680.md): A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denia (CVSS 8.8)
- [CVE-2023-2161](https://cve.now/CVE-2023-2161.md): A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file (CVSS 5.0)
- [CVE-2023-25620](https://cve.now/CVE-2023-25620.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller (CVSS 6.5)
- [CVE-2023-25619](https://cve.now/CVE-2023-25619.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller w (CVSS 7.5)
- [CVE-2023-28004](https://cve.now/CVE-2023-28004.md): A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted Ethernet request could result in denial o (CVSS 9.8)
- [CVE-2023-29410](https://cve.now/CVE-2023-29410.md): A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the appli (CVSS 7.2)
- [CVE-2023-29413](https://cve.now/CVE-2023-29413.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthe (CVSS 7.5)
- [CVE-2023-29412](https://cve.now/CVE-2023-29412.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rem (CVSS 9.8)
- [CVE-2023-29411](https://cve.now/CVE-2023-29411.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leadin (CVSS 9.8)
- [CVE-2023-28003](https://cve.now/CVE-2023-28003.md): A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijac (CVSS 6.7)
- [CVE-2023-25555](https://cve.now/CVE-2023-25555.md): A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists tha (CVSS 5.6)
- [CVE-2023-25553](https://cve.now/CVE-2023-25553.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE en (CVSS 6.1)
- [CVE-2023-25551](https://cve.now/CVE-2023-25551.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE file (CVSS 6.1)
- [CVE-2023-25550](https://cve.now/CVE-2023-25550.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the (CVSS 7.2)
- [CVE-2023-25549](https://cve.now/CVE-2023-25549.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when u (CVSS 7.2)
- [CVE-2023-25554](https://cve.now/CVE-2023-25554.md): A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a (CVSS 7.8)
- [CVE-2023-25552](https://cve.now/CVE-2023-25552.md): A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, o (CVSS 8.1)
- [CVE-2023-25548](https://cve.now/CVE-2023-25548.md): A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being p (CVSS 8.8)
- [CVE-2023-25547](https://cve.now/CVE-2023-25547.md): A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker (CVSS 8.8)
- [CVE-2022-43378](https://cve.now/CVE-2022-43378.md): A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into pe (CVSS 6.5)
- [CVE-2022-43377](https://cve.now/CVE-2022-43377.md): A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brut (CVSS 7.5)
- [CVE-2022-43376](https://cve.now/CVE-2022-43376.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code (CVSS 7.6)
- [CVE-2022-34755](https://cve.now/CVE-2022-34755.md): A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a s (CVSS 6.3)
- [CVE-2023-25556](https://cve.now/CVE-2023-25556.md): A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is (CVSS 8.3)
- [CVE-2023-1548](https://cve.now/CVE-2023-1548.md): A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the cons (CVSS 5.5)
- [CVE-2023-27976](https://cve.now/CVE-2023-27976.md): A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a mali (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/schneider-electric
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.