Product by Schneider Electric
Ecostruxure Machine Expert
23 known vulnerabilities in Ecostruxure Machine Expert (Schneider Electric), 0 of them actively exploited (CISA KEV).
Key figures
23
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2020-7489 | Schneider Electric Ecostruxure Machine Expert: Injection | 9.8 | |
| High | CVE-2021-21866 | CODESYS: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2021-21867 | CODESYS: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2021-21868 | CODESYS: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2021-21864 | CODESYS: Deserialization of Untrusted Data | 7.8 | |
| High | CVE-2021-21865 | CODESYS: Deserialization of Untrusted Data | 8.8 | |
| Critical | CVE-2021-22704 | Schneider Electric Ecostruxure Machine Expert: Path Traversal | 9.1 | |
| Critical | CVE-2021-33485 | CODESYS Control: Heap-Based Buffer Overflow | 9.8 | |
| High | CVE-2021-21863 | CODESYS: Deserialization of Untrusted Data | 8.8 | |
| High | CVE-2021-29241 | CODESYS Gateway: NULL Pointer Dereference | 7.5 | |
| High | CVE-2024-2658 | Local privilege escalation in FlexNet Publisher | — | |
| Critical | CVE-2020-7487 | Schneider Electric Ecostruxure Machine Expert: Insufficient Verification of Data Authenticity | 9.8 | |
| High | CVE-2021-29240 | CODESYS Development System: security vulnerability | 7.8 | |
| High | CVE-2020-7488 | Schneider Electric Ecostruxure Machine Expert: Cleartext Transmission of Sensitive Information | 7.5 | |
| High | CVE-2025-3112 | Schneider Electric Modicon Controllers M241/M251: Uncontrolled Resource Consumption | 6.5 | |
| High | CVE-2025-2875 | Schneider Electric Modicon Controllers M241 / M251: Externally Controlled Reference to a Resource in Another Sphere | 7.5 | |
| High | CVE-2025-3898 | Schneider Electric Modicon Controllers M241/M251: Improper Input Validation | 6.5 | |
| High | CVE-2025-3116 | Schneider Electric Modicon Controllers M241/M251: Improper Input Validation | 6.5 | |
| High | CVE-2024-8306 | Schneider Electric Vijeo Designer: Improper Privilege Management | 7.8 | |
| High | CVE-2021-22705 | Schneider Electric Ecostruxure Machine Expert: Improper Restriction of Operations within the Bounds of a Memory Buffer | 7.8 | |
| Medium | CVE-2025-3905 | Schneider Electric Modicon Controllers M241/M251: Cross-site Scripting | 5.4 | |
| Medium | CVE-2025-3117 | Schneider Electric Modicon Controllers M241/M251: Cross-site Scripting | 5.4 | |
| Medium | CVE-2025-3899 | Schneider Electric Modicon Controllers M241/M251: Cross-site Scripting | 5.4 |