Which versions of EcoStruxure Rapsody are affected by CVE-2025-13845?

Schneider Electric EcoStruxure Power Build (Rapsody) contains a critical arbitrary code execution vulnerability triggered by importing malicious project files; no public exploit identified at time of…

How to fix or mitigate CVE-2025-13845?

Within 24 hours, inventory all engineering workstations running EcoStruxure Power Build (Rapsody) and implement immediate restrictions on SSD project file imports from external sources; notify end users not to open unsolicited project files and enable audit logging for all file operations. Within 7 days, deploy network segmentation to isolate these workstations from production environments and critical infrastructure, and establish a formal approval workflow requiring engineering management sign-off before importing any external project files. Within 30 days, contact Schneider Electric to confirm patch timeline and develop a comprehensive remediation plan; evaluate alternative design tools if extended timeline impacts critical projects, and maintain heightened monitoring and logging until patched versions are available and deployed.

EcoStruxure Rapsody CVE-2025-13845

Q: What is the CVSS score of CVE-2025-13845?

CVE-2025-13845 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Use After Free (CWE-416)

2026-01-15 cybersecurity@se.com

RCE Denial Of Service Use After Free Memory Corruption Schneider Electric Ecostruxure Power Build Rapsody

8.4

CVSS 4.0 · Vendor: se

Severity by source

Vendor (se) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local file-import vector (AV:L) requiring the user to open a malicious SSD file (UI:R) with no prior privileges (PR:N); memory-corruption RCE gives full C/I/A within the unchanged workstation scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (se).

CVSS VectorVendor: se

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 27, 2026 - 17:37 NVD

8.4 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 15, 2026 - 19:16 nvd

N/A

CVE Published

Jan 15, 2026 - 19:16 cve.org

HIGH 8.4

DescriptionCVE.org

CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody.

AnalysisAI

Arbitrary code execution in Schneider Electric EcoStruxure Power Build - Rapsody occurs when a user imports a maliciously crafted SSD project file, triggering a use-after-free condition (CWE-416) that yields full confidentiality, integrity and availability impact on the engineering workstation. Exploitation requires the victim to actively open the attacker-supplied file, so it is a client-side/local vector rather than a remotely reachable service. There is no public exploit identified at time of analysis and EPSS probability is very low (0.02%), consistent with a targeted social-engineering delivery rather than mass exploitation.

Technical ContextAI

EcoStruxure Power Build - Rapsody is Schneider Electric design/quotation software used by electrical engineers to configure low-voltage switchboards and power distribution assemblies. The flaw is a CWE-416 Use After Free in the parser that deserializes SSD project files: the application frees a memory object but retains and later dereferences a dangling pointer while processing crafted file contents, allowing an attacker to control freed-and-reallocated memory and steer execution flow. The affected CPEs all reference cpe:2.3:a:schneider-electric:ecostruxure_power_build_-_rapsody across multiple localized builds (fr, nl, bel_en, bel_fr, int_en, esp, pt), indicating the defect is in the shared core rather than a single locale package.

RemediationAI

Apply the fix described in Schneider Electric advisory SEVD-2026-013-04 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-013-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-013-04.pdf); the exact patched version is not present in the supplied data, so confirm the target build directly from that notice - Patch available per vendor advisory, released patched version not independently confirmed here. Until the fixed release is deployed, restrict the primary attack path by only importing SSD project files received from trusted, verified sources and validating file provenance before opening, since exploitation depends entirely on a user importing a malicious file. As a compensating control, run Rapsody under a least-privileged user account and on segmented engineering workstations so a successful UAF-driven RCE cannot immediately pivot into OT/production networks; the trade-off is added workflow friction when exchanging project files between integrators and Schneider partners.