TL;DR

A critical vulnerability in Schneider Electric's EcoStruxure Power Build enables remote attackers to execute arbitrary code via malicious files or web pages with a CVSS score of 7.8.

What happened

["Schneider Electric's EcoStruxure Power Build is affected by a memory corruption flaw"]

Why it matters for ops

['Remote attackers can exploit the vulnerability for RCE through malicious files or webpages', 'Requires user interaction to execute']

Mitigation

  • Apply vendor patches immediately upon release
  • Limit access to affected systems
  • Monitor for suspicious activity and log analysis

Action items

  • Update to the latest version of EcoStruxure Power Build as soon as possible
  • Implement strict security policies around file handling

Detection IOCs

  • Memory corruption patterns in EcoStruxure Power Build logs
  • Suspicious network traffic related to SSD file parsing

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-087/