PT-2026-24261 · Schneider Electric · Ecostruxure™ Automation Expert

Published 2026-03-10 · Updated 2026-03-16 · CVE-2026-2273

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description An issue exists that allows for the execution of untrusted commands on an engineering workstation. This could lead to a limited compromise of the workstation and potential loss of Confidentiality, Integrity, and Availability of subsequent systems when a malicious project file is opened by an authenticated user. The issue is due to improper control of code generation, specifically a 'Code Injection' condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-03443

CVE-2026-2273

Affected Products

Ecostruxure™ Automation Expert

References · 4

• https://bdu.fstec.ru/vul/2026-03443 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2273 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-04.pdf · Note
• https://twitter.com/CVEnew/status/2033361107495051278 · Twitter Post