CVE-2024-8401
Medium
Description
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.
SeverityMedium
CVSS5.4
Exploit probability—
ProductEcoStruxure Power Monitoring Expert (PME) 2021
PublishedJan 28, 2025
First seenJan 28, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Schneider Electric EcoStruxure Power Monitoring Expert (PME) 2021 | 2021 CU1 and prior | — |
| Schneider Electric EcoStruxure Power Monitoring Expert (PME) 2020 | 2020 CU3 and prior | — |
| Schneider Electric EcoStruxure Power Operation (EPO) 2022 | CU4 and prior | — |
| Schneider Electric EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module | CU4 and prior | — |
| Schneider Electric EcoStruxure Power Operation (EPO) 2021 | CU4 and prior | — |
| Schneider Electric EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module | CU3 with Hotfix 2 and prior | — |
| Schneider Electric EcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.