ZDI-CAN-27390: ZDI-26-088: Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-13845.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-27390?
ZDI-CAN-27390 has been classified with a critical severity due to its potential for remote code execution.
How do I fix ZDI-CAN-27390?
To address ZDI-CAN-27390, update Schneider Electric EcoStruxure Power Build to the latest version as recommended by the vendor.
What types of attacks can exploit ZDI-CAN-27390?
ZDI-CAN-27390 can be exploited via crafted SSD files that lead to memory corruption and potentially allow remote code execution.
Is user interaction required to exploit ZDI-CAN-27390?
Yes, user interaction is necessary for exploiting ZDI-CAN-27390, as it typically involves opening a malicious file.
Which software is affected by ZDI-CAN-27390?
ZDI-CAN-27390 affects Schneider Electric EcoStruxure Power Build installations.