TL;DR

A critical remote code execution vulnerability in Schneider Electric's EcoStruxure Power Build, exploitable through malicious files or web pages, rated CVSS 7.8.

What happened

["Schneider Electric's EcoStruxure Power Build is affected by a memory corruption flaw", 'The vulnerability allows for remote code execution with user interaction']

Why it matters for ops

['Affects software responsible for industrial control systems', 'Exploitation requires minimal user action, increasing risk of attack']

Mitigation

  • Apply vendor-provided updates and patches immediately
  • Implement strict file security policies and user awareness training

Action items

  • Identify and inventory all instances of EcoStruxure Power Build in use
  • Update to the latest version available from Schneider Electric

Detection IOCs

  • Unusual outbound network traffic from affected devices
  • Unexpected system behavior or crashes after visiting suspicious web pages

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-090/