Schneider Electric Ecostruxure Power Monitoring Expert vulnerabilities

15 CVEs affecting Schneider Electric Ecostruxure Power Monitoring Expert, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-11739, published 2026-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-7545, published 2020-12-01. High severity, CVSS 7.2. EPSS: 2.1% chance of exploitation in the next 30 days. A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow for…
CVE-2020-7547, published 2020-12-01. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow a…
CVE-2022-22727, published 2022-02-04. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a…
CVE-2021-22827, published 2022-01-28. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22826.…
CVE-2021-22826, published 2022-01-28. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload. This CVE is unique from CVE-2021-22827.…
CVE-2023-5391, published 2023-10-04. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to…
CVE-2022-22726, published 2022-02-04. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected…
CVE-2018-7797, published 2018-12-17. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxure Energy Expert…
CVE-2020-7546, published 2020-12-01. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for…
CVE-2023-5986, published 2023-11-15. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By providing a URL-encoded input attackers…

Latest

CVE-2025-11739, published 2026-03-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data…
CVE-2024-2229, published 2024-03-18. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user.
CVE-2023-5987, published 2023-11-15. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross site scripting condition where attackers…
CVE-2023-28003, published 2023-04-18. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out…
CVE-2022-22804, published 2022-02-04. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact…