Schneider electric EcoStruxure™ CVE-2023-28003

Overview
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert
product (PME).
EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power-
critical and energy-intensive facilities maximize uptime and operational efficiency.
Failure to apply the mitigation provided below may risk a session expiration vulnerability, which
would allow an attacker unauthorized access over a hijacked session.


Vulnerability Details
CVE ID: CVE-2023-28003
CVSS v3.1 Base Score 6.7 | Medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to
maintain unauthorized access over a hijacked session in PME after the legitimate user has
signed out of their account.

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-073-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-073-01.pdf&_ga=2.167028150.924949432.1680765225-478557281.1680765225
https://www.se.com/ww/en/work/support/cybersecurity/wall-of-thanks.jsp