TL;DR
A critical vulnerability in Schneider Electric EcoStruxure Power Build enables attackers to execute arbitrary code by exploiting file parsing flaws with user interaction required.
What happened
["Schneider Electric's EcoStruxure Power Build is susceptible to a memory corruption flaw due to improper handling of SSD files.", 'Exploitation requires user action such as visiting a malicious site or opening an infected file.']
Why it matters for ops
['Failure to address this vulnerability can result in remote code execution on affected systems.', 'User interaction required reduces the immediate threat but does not eliminate it completely.']
Mitigation
- Apply vendor-provided patches as soon as they are available.
- Disable unnecessary file parsing features in the application.
Action items
- Update EcoStruxure Power Build software immediately to address CVE-2025-13845.
- Monitor system logs for any signs of suspicious activity related to SSD files.
Detection IOCs
- Unexpected behavior or crashes when opening SSD files
- Unusual network traffic to/from the affected server