Easergy Studio
Plan Patch7.8SEVD-2024-009-02Jan 9, 2024
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Easergy Studio is vulnerable to a privilege escalation flaw (CWE-502 deserialization of untrusted data). An attacker with a user-level account on the engineering workstation can escalate privileges to gain full control of that workstation. All versions prior to 9.3.5 are affected.
What this means
What could happen
An attacker with regular user access to an engineering workstation running Easergy Studio could gain administrator-level control, allowing them to modify device configurations, inject malicious commands into control logic, or disrupt management of critical energy infrastructure devices.
Who's at risk
Energy utilities using Schneider Electric's Easergy Studio for configuration and monitoring of control devices. This affects engineering teams that manage protection relays, switchgear control, and other critical devices via Easergy Studio. Any organization with Easergy Studio versions before 9.3.5 on engineering workstations is at risk.
How it could be exploited
An attacker with a user-level account on the engineering workstation exploits the deserialization flaw in Easergy Studio to escalate privileges to administrator level. Once elevated, the attacker can modify configuration files, alter control settings for any connected devices, or install persistent backdoors on the workstation.
Prerequisites
- User-level account on the engineering workstation running Easergy Studio
- Local access to the workstation or ability to execute code under an existing user context
- Easergy Studio version prior to 9.3.5 must be installed
privilege escalation vulnerabilityaffects engineering workstations with direct access to device configurationlocal exploitation only (reduces risk but impacts trusted internal staff)deserialization flaw (complex attack but no user interaction required
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
Easergy Studio all verisons prior to 9.3.5<9.3.59.3.5
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict user-level account permissions on engineering workstations to only those who require them for legitimate configuration work
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpdate Easergy Studio to version 9.3.6 or later via SESU (Schneider Electric Software Update) or direct download from Schneider Electric website
HARDENINGReview access logs and audit trails for any unauthorized privilege escalation attempts on workstations running Easergy Studio
Long-term hardening
0/1HARDENINGImplement local access controls and endpoint security on engineering workstations to detect and prevent privilege escalation attempts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/0dbe0bc8-9e68-4421-a136-9fea74eceaab