TL;DR

Schneider Electric's EcoStruxure Power Build is vulnerable to a remote code execution attack through a use-after-free flaw, necessitating immediate mitigation strategies.

What happened

["Schneider Electric's EcoStruxure Power Build contains a critical vulnerability that can lead to remote code execution.", 'The issue arises from improper handling of SSD files which may result in a use-after-free condition.']

Why it matters for ops

['Remote attackers could exploit this flaw to execute arbitrary code on the affected systems.', 'Exploitation requires user interaction such as visiting a malicious webpage or opening a file.']

Mitigation

  • Apply the latest security updates provided by Schneider Electric.
  • Restrict access to potential exploit vectors such as network shares and email attachments.

Action items

  • Update EcoStruxure Power Build to address CVE-2025-13845
  • Monitor for signs of exploitation in affected environments

Detection IOCs

  • CVE-2025-13845
  • ZDI-26-094
  • Use-after-free condition in SSD file parsing

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-094/