CVE-2024-9005 Schneider Electric CVE debrief

Who should care

Organizations running Schneider Electric EcoStruxure Power Monitoring Expert (PME), especially PME 2022 and any 2021-or-older deployments. Security and operations teams responsible for industrial control or building/energy monitoring environments should prioritize this advisory.

Technical summary

The advisory describes a CWE-502 deserialization-of-untrusted-data issue affecting Schneider Electric EcoStruxure Power Monitoring Expert (PME). The supplied CVSS v3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating network reachability with additional exploitation conditions, low privileges, and required user interaction. The reported impact is remote code execution on the server when unsafe serialized input is posted to the web server. A vendor hotfix is available for PME 2022; PME 2021 and prior are listed as end-of-life and should be replaced or upgraded.

Defensive priority

High: apply the PME 2022 hotfix promptly, and plan immediate migration off unsupported PME 2021-and-prior systems.

Recommended defensive actions

• Apply Schneider Electric Hotfix_75031_PME2022 for EcoStruxure Power Monitoring Expert (PME) 2022 through Schneider Electric Customer Care Center.
• Upgrade PME 2021 and prior to a supported current version; the advisory states these versions have reached end-of-life support.
• Follow CISA ICS recommended practices and defense-in-depth guidance while remediation is scheduled.
• Review any exposure of the PME web server and restrict access to trusted administrative paths until remediation is complete.

Evidence notes

Primary evidence comes from CISA CSAF advisory ICSA-25-037-01 and Schneider Electric Security and Safety Notice SEVD-2024-282-05, both published on 2024-10-08 and updated on 2025-05-13. The advisory lists affected products as Schneider Electric EcoStruxure Power Monitoring Expert (PME) Version 2022 and Version 2021 and prior, and states that unsafe deserialization can permit remote code execution on the server. Remediation details in the source include Hotfix_75031_PME2022 for PME 2022 and upgrade guidance for unsupported versions.

Official resources