CVE-2024-8401: Schneider Electric Ecostruxure Power Monitoring Expert Pme 2020

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.

Affected products

• Schneider Electric Ecostruxure Power Monitoring Expert Pme 2020: up to and including 2020 CU3
• Schneider Electric Ecostruxure Power Monitoring Expert Pme 2021: up to and including 2021 CU1
• Schneider Electric Ecostruxure Power Operation Epo 2021
• Schneider Electric Ecostruxure Power Operation Epo 2021 – Advanced Reporting And Dashboards Module
• Schneider Electric Ecostruxure Power Operation Epo 2022
• Schneider Electric Ecostruxure Power Operation Epo 2022 – Advanced Reporting And Dashboards Module
• Schneider Electric Ecostruxure Power Scada Operation 2020 Pso - Advanced Reporting And Dashboards Module: any version

Published 2025-01-28. Last modified 2026-06-17.