View CSAF

CVSS v3 8.8

ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation

Vendor: Schneider Electric

Equipment: EcoStruxure Power Operation

Vulnerabilities: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), Integer Overflow to Buffer Overflow, Improper Handling of Highly Compressed Data (Data Amplification), Out-of-bounds Write, Uncontrolled Resource Consumption

Successful exploitation of these vulnerabilities could result in the loss of system functionality or unauthorized access to system functions.

Schneider Electric reports the following products use an affected version of the PostgreSQL database server:

EcoStruxure Power Operation (EPO): 2022 CU6 and prior

EcoStruxure Power Operation (EPO): 2024 CU1 and prior

Pillow Version 10.1.0 allows PIL.ImageMath.eval arbitrary code execution via the environment parameter. This is a different vulnerability from CVE-2022-22817, which pertains to the expression parameter.

CVE-2023-50447 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.1 has been calculated; the CVSS vector string is ().

In _imagingcms.c in Pillow prior to 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

CVE-2024-28219 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.7 has been calculated; the CVSS vector string is ().

Versions of Pillow before 9.2.0 improperly handle highly compressed GIF data (data amplification).

CVE-2022-45198 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is ().

A heap buffer overflow in vp8 encoding in libvpx, used by Google Chrome versions prior to 117.0.5938.132 and libvpx Version 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2023-5217 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.8 has been calculated; the CVSS vector string is ().

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RST_STREAM  immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWAY frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if the connection is already marked for not sending more requests due to GOAWAY frame. The clean-up code is right after the return statement, causing a memory leak. This results in denial of service through memory exhaustion. This vulnerability was patched in Versions 1.26.3, 1.25.8, 1.24.9, 1.23.11.

CVE-2023-35945 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is ().

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as was exploited in the wild from August to October 2023.

CVE-2023-44487 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is ().

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy

COUNTRIES/AREAS DEPLOYED: Worldwide

COMPANY HEADQUARTERS LOCATION: France

Schneider Electric reported these vulnerabilities to CISA.

EcoStruxure Power Operation 2024 CU2 includes fixes for these vulnerabilities and is .

Schneider Electric recommends users to employ appropriate patching methodologies when applying these patches to their systems. They strongly recommend making backups and evaluating the impact of these patches in a test and development environment or on offline infrastructure. Contact Schneider Electric's Customer Care Center for assistance removing a patch.

If users choose not to apply the remediation mentioned above, Schneider Electric recommends the following:

For more information, see the associated Schneider Electric security advisory SEVD-2025-189-03: EcoStruxure Power Operation PDF version, CSAF version.

Schneider Electric strongly recommends adhering to the following industry cybersecurity best practices:

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

July 22, 2025: Initial Republication of Schneider Electric SEVD-2025-189-03