Wiser Home Automation

A buffer overflow vulnerability in the bootloader of these home automation devices could allow an attacker to persistently execute arbitrary code on the device, potentially disrupting energy management or home automation functions in buildings with integrated Wiser systems.

Facilities and building automation integrators using Schneider Electric Wiser home automation products (Wiser Cuadro H 5P Socket or Wiser AvatarOn 6K Freelocate) in energy management or smart grid deployments should isolate these devices and strengthen network controls. This primarily affects building operators and facility managers in the energy sector who use Wiser for smart socket or control relay functions.

An attacker with network access to the device (over Wi-Fi or LAN) could exploit the Gecko Bootloader vulnerability to trigger a buffer overflow, gaining the ability to inject and run malicious code that persists across reboots. This requires the device to be reachable on the network—either directly if exposed to the internet, or via compromise of another device on the same network segment.