TL;DR

Remote Code Execution vulnerability (CVE-2025-13845) found in Schneider Electric's EcoStruxure Power Build software due to improper handling of SSD files, leading to memory corruption and potential remote code execution with user interaction required.

What happened

['Vulnerability allows RCE via improper SSD file parsing', 'CVE-2025-13845 has CVSS rating of 7.8']

Why it matters for ops

['Improper handling of files can lead to remote code execution', 'User interaction is required for exploitation']

Mitigation

  • Update to the latest version of EcoStruxure Power Build
  • Avoid opening untrusted SSD files
  • Enable strict security policies and monitor for suspicious activity

Action items

  • Apply available patches immediately
  • Review and restrict file access permissions
  • Conduct an audit of existing systems using affected software

Detection IOCs

  • Malicious SSD files being distributed
  • Unexpected process crashes or system instability after interacting with unknown SSD files

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-084/