Ecostruxure Power Build Rapsody
Monthly
Arbitrary code execution in Schneider Electric EcoStruxure Power Build - Rapsody occurs when a user imports a maliciously crafted SSD project file, triggering a use-after-free condition (CWE-416) that yields full confidentiality, integrity and availability impact on the engineering workstation. Exploitation requires the victim to actively open the attacker-supplied file, so it is a client-side/local vector rather than a remotely reachable service. There is no public exploit identified at time of analysis and EPSS probability is very low (0.02%), consistent with a targeted social-engineering delivery rather than mass exploitation.
Heap memory corruption via double free in Schneider Electric's EcoStruxure Power Build - Rapsody enables arbitrary code execution when an engineer imports a crafted SSD project file delivered by an attacker. The vulnerability spans all localized editions of the software (French, Belgian Dutch, Spanish, International, and Belgian French) with no upper version bound confirmed in NVD CPE data. No public exploit has been identified and no CISA KEV listing exists; however, the file-based social engineering delivery path is realistic and well-suited to targeted attacks against industrial design personnel.
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Arbitrary code execution in Schneider Electric EcoStruxure Power Build - Rapsody occurs when a user imports a maliciously crafted SSD project file, triggering a use-after-free condition (CWE-416) that yields full confidentiality, integrity and availability impact on the engineering workstation. Exploitation requires the victim to actively open the attacker-supplied file, so it is a client-side/local vector rather than a remotely reachable service. There is no public exploit identified at time of analysis and EPSS probability is very low (0.02%), consistent with a targeted social-engineering delivery rather than mass exploitation.
Heap memory corruption via double free in Schneider Electric's EcoStruxure Power Build - Rapsody enables arbitrary code execution when an engineer imports a crafted SSD project file delivered by an attacker. The vulnerability spans all localized editions of the software (French, Belgian Dutch, Spanish, International, and Belgian French) with no upper version bound confirmed in NVD CPE data. No public exploit has been identified and no CISA KEV listing exists; however, the file-based social engineering delivery path is realistic and well-suited to targeted attacks against industrial design personnel.
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.