CVE-2024-10575 Schneider Electric CVE debrief

Who should care

Organizations operating Schneider Electric EcoStruxure™ IT Gateway versions 1.21.0.6 through 1.23.0.4 in production environments, particularly those with network-exposed Gateway deployments. Critical infrastructure operators, data center managers, and industrial facility security teams relying on EcoStruxure™ IT for environmental monitoring and device management should prioritize this patch. Organizations with automatic updates disabled or manual update processes must take immediate action.

Technical summary

The vulnerability stems from missing authorization controls in the EcoStruxure™ IT Gateway web API when exposed to network access. Affected versions (1.21.0.6, 1.22.0.3, 1.22.1.5, 1.23.0.4) do not properly enforce authentication for certain operations, enabling unauthorized actors to access the Gateway and potentially impact connected infrastructure devices. The attack vector is network-based with low complexity, requiring no privileges or user interaction. The confidentiality, integrity, and availability impacts are all rated high. Version 1.23.1.10 remediates this authorization gap.

Defensive priority

critical

Recommended defensive actions

• Upgrade to EcoStruxure™ IT Gateway version 1.23.1.10 immediately if running affected versions 1.21.0.6 through 1.23.0.4
• Enable automatic updates to receive future security patches promptly
• If immediate patching is not possible, place the Gateway on access-controlled networks only and implement local firewall rules to deny remote access to the web API
• Consider removing affected Gateway software and performing a clean installation of version 1.23.1.10 as an alternative remediation path
• Review network segmentation for EcoStruxure™ IT Gateway deployments to limit exposure of connected devices

Evidence notes

CISA ICS advisory ICSA-24-326-05 confirms the vulnerability affects four specific product versions and provides remediation guidance. Schneider Electric's security notice SEVD-2024-317-04 documents the vendor fix in version 1.23.1.10.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.