TL;DR

Schneider Electric's EcoStruxure Power Build suffers from a memory corruption flaw that can be exploited for remote code execution with user interaction.

What happened

['Remote attackers exploiting Schneider Electric EcoStruxure Power Build vulnerability', 'Malicious file parsing leads to memory corruption']

Why it matters for ops

['Requires user interaction, increasing risk of exploitation in targeted attacks', 'CVSS rating indicates high severity and potential impact on system integrity and availability']

Mitigation

  • Update to the latest version of EcoStruxure Power Build as soon as available
  • Implement strict controls on file handling and user interaction

Action items

  • Review system configurations for potential exposure
  • Develop a plan to update affected systems

Detection IOCs

  • Malicious file parsing attempts targeting EcoStruxure Power Build installations
  • Unusual network traffic related to remote code execution attempts

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-091/