SB2025072325 - Multiple vulnerabilities in Schneider Electric EcoStruxure Power Operation

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025072325

SB2025072325 - Multiple vulnerabilities in Schneider Electric EcoStruxure Power Operation

Published: July 23, 2025

Security Bulletin ID SB2025072325
Severity
Critical
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 14% High 43% Medium 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 secuirty vulnerabilities.


1) Exposed dangerous method or function (CVE-ID: CVE-2022-22817)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of PIL.ImageMath.eval() function on arbitrary expressions. A remote attacker can pass specially crafted file to the library and execute arbitrary code on the system.


2) Code Injection (CVE-ID: CVE-2023-50447)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the PIL.ImageMath.eval function. A remote attacker can send a specially crafted input to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Buffer overflow (CVE-ID: CVE-2024-28219)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in "_imagingcms.c". A remote user can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) Resource management error (CVE-ID: CVE-2022-45198)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources when handing highly compressed GIF data. A remote attacker can pass specially crafted GIF file to the application and perform a denial of service (DoS) attack.


5) Heap-based buffer overflow (CVE-ID: CVE-2023-5217)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in vp8 encoding in libvpx. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.


6) Memory leak (CVE-ID: CVE-2023-35945)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when handling HTTP/2 requests within the nghttp2 codec. A remote attacker can send RST_STREAM immediately followed by the GOAWAY frames to the application and force memory leak.


7) Resource exhaustion (CVE-ID: CVE-2023-44487)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".

Note, the vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

References