Improper Control of Generation of Code ('Code Injection') vulnerability on EcoStruxure™ Automation Expert

An attacker with local access to an engineering workstation could inject code and run arbitrary commands, potentially compromising the entire automation system configuration and control logic used to manage industrial processes.

Energy sector utilities and manufacturing facilities running Schneider Electric's EcoStruxure™ Automation Expert for plant automation and discrete, hybrid, or continuous process control should apply this patch. This affects engineering teams who develop and maintain PLC/automation logic.

An attacker with local access to an engineering workstation running EcoStruxure™ Automation Expert could exploit the code injection flaw through user interaction (e.g., opening a malicious project file or accepting a prompt) to execute arbitrary commands with the privileges of the engineering user, potentially gaining full control of system configurations.