ZDI-CAN-27371: ZDI-26-084: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-27371?
The severity of ZDI-CAN-27371 is critical due to the potential for remote code execution.
How do I fix ZDI-CAN-27371?
To fix ZDI-CAN-27371, ensure you update to the latest version of Schneider Electric EcoStruxure Power Build that addresses this vulnerability.
What types of attacks can exploit ZDI-CAN-27371?
ZDI-CAN-27371 can be exploited through crafted SSD files that lead to memory corruption and arbitrary code execution.
Is user interaction required to exploit ZDI-CAN-27371?
Yes, user interaction is required to exploit ZDI-CAN-27371 since the attacker must convince the user to open a malicious SSD file.
Which software is affected by ZDI-CAN-27371?
ZDI-CAN-27371 affects Schneider Electric EcoStruxure Power Build installations.