Read the docs
TI-2024-07789 Aliases CVE-2024-8401GHSA-vqxv-7634-4c22

Cross-site scripting in Schneider Electric EcoStruxure Power Monitoring Expert 2021

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schneider ElectricEcoStruxure Power Monitoring Expert (PME) 20212021 CU1 and prior—No fix listedCNA
Schneider ElectricEcoStruxure Power Monitoring Expert (PME) 20202020 CU3 and prior—No fix listedCNA
Schneider ElectricEcoStruxure Power Operation (EPO) 2022CU4 and prior—No fix listedCNA
Schneider ElectricEcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards ModuleCU4 and prior—No fix listedCNA
Schneider ElectricEcoStruxure Power Operation (EPO) 2021CU4 and prior—No fix listedCNA
Schneider ElectricEcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards ModuleCU3 with Hotfix 2 and prior—No fix listedCNA
Schneider ElectricEcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards ModuleAll Versions—No fix listedCNA
  • EcoStruxure Power Monitoring Expert (PME) 2021 VendorSchneider Electric Affected 2021 CU1 and prior Fixed in — No fix listed CNA
  • EcoStruxure Power Monitoring Expert (PME) 2020 VendorSchneider Electric Affected 2020 CU3 and prior Fixed in — No fix listed CNA
  • EcoStruxure Power Operation (EPO) 2022 VendorSchneider Electric Affected CU4 and prior Fixed in — No fix listed CNA
  • EcoStruxure Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module VendorSchneider Electric Affected CU4 and prior Fixed in — No fix listed CNA
  • EcoStruxure Power Operation (EPO) 2021 VendorSchneider Electric Affected CU4 and prior Fixed in — No fix listed CNA
  • EcoStruxure Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module VendorSchneider Electric Affected CU3 with Hotfix 2 and prior Fixed in — No fix listed CNA
  • EcoStruxure Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module VendorSchneider Electric Affected All Versions Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8401
  2. 2026-10-03 Alias added: GHSA-vqxv-7634-4c22

References

Other 1

  • TI-2018-05679 SQL injection in U.motion Builder software version 1.3.4 KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05589 Hard-coded credentials in EVlink City , EVlink Parking , and EVlink Smart Wallbox CVSS 3.1CRITICAL 9.8
  • TI-2022-15561 OS command injection in Schneider Electric SpaceLogic C-Bus Home Controller CVSS 3.1HIGH 8.8
  • TI-2023-04970 Path traversal in Schneider Electric C-Bus Toolkit CVSS 3.1CRITICAL 9.8
  • TI-2019-04862 Improper handling of exceptional conditions in Schneider Electric Modicon M580 CVSS 3.1HIGH 7.5
  • TI-2018-05690 Improper handling of exceptional conditions in Modicon M580 Modicon M340 Modicon Quantum… CVSS 3.1HIGH 7.5
See all 888 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences