PatchSiren cyber security CVE debrief

CVE-2024-9002 Schneider Electric CVE debrief

A privilege escalation vulnerability in Schneider Electric Easergy Studio allows authenticated non-administrative users to tamper with binaries to gain elevated privileges, potentially compromising workstation confidentiality, integrity, and availability. The vulnerability stems from improper privilege management (CWE-269) and requires local access with low privileges but no user interaction. Schneider Electric released a fix in December 2022 with version 9.3.4; users should upgrade to the latest available version.

Vendor: Schneider Electric
Product: Easergy Studio
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-10-08
Original CVE updated: 2024-10-08
Advisory published: 2024-10-08
Advisory updated: 2024-10-08

Who should care

Organizations using Schneider Electric Easergy Studio for protection relay configuration and management, particularly in electric utility and industrial environments where workstation integrity is critical for operational technology (OT) security.

Technical summary

CVE-2024-9002 is a CWE-269 Improper Privilege Management vulnerability in Schneider Electric Easergy Studio versions 9.3.1 and prior. The vulnerability allows authenticated non-administrative users to escalate privileges by tampering with application binaries, resulting in unauthorized access and potential loss of confidentiality, integrity, and availability on the affected workstation. The attack requires local access with low privileges but no user interaction. Schneider Electric addressed this vulnerability in version 9.3.4, released in December 2022.

Defensive priority

high

Recommended defensive actions

Upgrade Easergy Studio to version 9.3.4 or later, which includes a fix released in December 2022
Apply the principle of least privilege to Easergy Studio user accounts
Restrict physical and logical access to Easergy Studio workstations to authorized personnel only
Monitor for unauthorized binary modifications or privilege escalation attempts on Easergy Studio installations
Follow CISA ICS recommended practices for defense-in-depth strategies in industrial control environments

Evidence notes

CISA ICS advisory ICSA-25-023-04 documents this vulnerability in Easergy Studio versions 9.3.1 and prior. The advisory confirms Schneider Electric released version 9.3.4 with a fix in December 2022. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local attack vector with high impact across confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

CVE-2024-9002 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-9002

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-9002 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-9002

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-023-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.se.com/us/en/download/document/7EN52-0390/

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.