CVE-2022-45198 Schneider Electric CVE debrief

Who should care

Schneider Electric EcoStruxure Power Operation administrators, OT/ICS operators, patch and change-management teams, and anyone running EPO 2022 CU6 or earlier, or EPO 2024 CU1 or earlier, especially if waveform analysis or ETAP simulation features are in use.

Technical summary

CISA republished Schneider Electric advisory ICSA-25-203-04 / SEVD-2025-189-03 for CVE-2022-45198. The advisory lists two affected product lines: EcoStruxure Power Operation (EPO) 2022 up to CU6 and EPO 2024 up to CU1. The remediation notes focus on updating to EPO 2022 CU7, applying patching carefully with backups and testing, and, where users do not need waveform analysis or ETAP simulation, uninstalling PostgreSQL; if those features are used, Schneider Electric recommends restricting PostgreSQL connections to localhost and upgrading PostgreSQL 14.10 to 14.17 or higher. The source text describing the CVE refers to a Pillow GIF data-amplification issue, but the advisory does not explain that linkage.

Defensive priority

High. The advisory is rated High (7.5) and the impact is availability-only, which is still operationally significant for OT environments. Prioritize any exposed or production EPO deployments that match the affected version ranges, then validate whether the PostgreSQL-related mitigations apply to your feature usage.

Recommended defensive actions

• Apply the Schneider Electric remediation path for your product version, including EPO 2022 CU7 where applicable.
• Back up systems and test patches in a non-production or offline environment before deployment.
• If waveform analysis and ETAP simulation are not used, follow the advisory guidance to uninstall PostgreSQL.
• If waveform analysis or ETAP simulation are used, restrict PostgreSQL to localhost-only connections as directed by Schneider Electric.
• Upgrade PostgreSQL 14.10 to 14.17 or higher where the advisory indicates it is needed.
• Limit control-system network exposure, keep EPO off the public Internet, and use segmented network architectures and secure remote access methods.

Evidence notes

This debrief is based only on the supplied CISA CSAF source item and its embedded advisory metadata. The source includes revision history showing initial republication on 2025-07-22 and Update A on 2026-02-25, plus affected-product entries for EPO 2022 <=CU6 and EPO 2024 <=CU1. The source corpus also contains a description string about Pillow before 9.2.0 and highly compressed GIF data, which does not match the Schneider Electric product scope; that inconsistency is preserved here as a quality note rather than resolved with unsupported assumptions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.