Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC
Priority LOW 29CWE-312Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.
Summary
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00125 2nd percentileScored 2026-11-07
Fix Fixed Ecostruxure™ Machine Expert HVAC (Schneider Electric): 1.10.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schneider Electric | Ecostruxure™ Machine Expert HVAC | before 1.10.0 | 1.10.0 | Patch available | CNA |
- Ecostruxure™ Machine Expert HVAC VendorSchneider Electric Affected before 1.10.0 Fixed in 1.10.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:ecostruxure_machine_expert_hvac:*:*:*:*:*:*:*:* | before 1.10.0 | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:ecostruxure_machine_expert_hvac:*:*:*:*:*:*:*:* Versions before 1.10.0 Vulnerable ·Schneider Electric
Remediation
- Fix · CNA Ecostruxure™ Machine Expert HVAC (Schneider Electric) Fixed in 1.10.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6332
- 2026-10-03 Alias added: GHSA-vg4w-v23f-w7r7
References
Sources
- CVE-2026-6332 · CVE Program
- CVE-2026-6332 · NVD
- FIRST EPSS
- GHSA-vg4w-v23f-w7r7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences