CVE-2022-2988: Schneider Electric Ecostruxure Machine Expert - Hvac

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC (Versions prior to V2.1.0), EcoStruxure Machine Expert – HVAC (Versions prior to V1.4.0)

Affected products

• Schneider Electric Ecostruxure Machine Expert - Hvac: before 1.4.0 (fixed in 1.4.0)
• Schneider Electric Somachine Hvac: before 2.1.0 (fixed in 2.1.0)

Published 2023-01-30. Last modified 2026-06-17.