Securing Power Systems: How to Remediate Schneider Electric EcoStruxure Vulnerabilities

Introduction

For organizations managing critical infrastructure or energy-intensive facilities, operational availability is just as important as data security. Schneider Electric has released an advisory regarding a significant vulnerability affecting its EcoStruxure Power Monitoring Expert (PME) and EcoStruxure Power Operation (EPO) platforms.

These on-premises solutions are widely used to monitor and control power systems. A vulnerability in these systems could allow attackers to execute arbitrary code locally. If left unpatched, this flaw poses a severe risk of operational disruption and unauthorized administrative control, potentially allowing attackers to manipulate power management systems.

Technical Analysis

The advisory (CISA ICSA-26-078-04) highlights a security weakness in specific versions of Schneider Electric’s EcoStruxure software.

Affected Products:

• EcoStruxure Power Monitoring Expert (PME): An on-premises software suite designed to help power critical facilities maximize uptime and efficiency.
• EcoStruxure Power Operation (EPO): An on-premises platform providing a single interface to monitor and control medium and lower power systems.

The Vulnerability: The flaw permits local arbitrary code execution. While this requires local access to the system initially, it can be combined with other techniques to escalate privileges. The impact is severe:

• System Compromise: Complete takeover of the local system hosting the software.
• Operational Disruption: Potential interference with power monitoring and control capabilities.
• Unauthorized Control: Attackers could gain administrative rights, altering configurations or exfiltrating sensitive operational data.

Failure to apply the vendor-provided fix leaves these critical systems exposed to takeover.

Defensive Monitoring

Defenders must quickly identify assets running EcoStruxure PME or EPO to verify patch status. Use the following scripts and queries to detect installations within your environment.

PowerShell Detection Script

This script scans the Windows Registry for installed instances of EcoStruxure PME or EPO and reports their version numbers.

<#
.SYNOPSIS
    Detects Schneider Electric EcoStruxure PME and EPO installations.
.DESCRIPTION
    Queries the registry for uninstall keys matching EcoStruxure PME or EPO to identify version numbers.
#>

$products = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*", "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue

$targetProducts = $products | Where-Object { 
    $_.DisplayName -match "EcoStruxure" -and 
    ($_.DisplayName -match "PME" -or $_.DisplayName -match "Power Operation" -or $_.DisplayName -match "EPO")
}

if ($targetProducts) {
    Write-Host "[+] Found Schneider Electric EcoStruxure installations:" -ForegroundColor Cyan
    foreach ($prod in $targetProducts) {
        [PSCustomObject]@{
            ComputerName = $env:COMPUTERNAME
            ProductName = $prod.DisplayName
            Version = $prod.DisplayVersion
            InstallDate = $prod.InstallDate
        } | Format-List
    }
} else {
    Write-Host "[-] No EcoStruxure PME or EPO installations detected." -ForegroundColor Green
}

Microsoft Sentinel KQL Query

Use this KQL query to hunt for devices within your fleet that have registry entries indicating the presence of EcoStruxure software.

DeviceRegistryEvents
| where RegistryKey contains @"Software\Microsoft\Windows\CurrentVersion\Uninstall"
| where RegistryValueName in ("DisplayName", "DisplayVersion")
| where RegistryValueData has "EcoStruxure" 
| extend ProductName = iff(RegistryValueName == "DisplayName", RegistryValueData, "")
| extend Version = iff(RegistryValueName == "DisplayVersion", RegistryValueData, "")
| summarize arg_max(Timestamp, *) by DeviceId, ProductName
| where ProductName contains "PME" or ProductName contains "Power Operation" or ProductName contains "EPO"
| project DeviceName, ProductName, Version, Timestamp

Remediation

To protect your organization from the risks associated with this vulnerability, Security Arsenal recommends the following immediate actions:

1. Apply Vendor Patches Immediately: Review the official Schneider Electric security advisory and the CISA advisory (ICSA-26-078-04). Download and install the specific security patches provided by Schneider Electric for the affected versions of EcoStruxure PME and EPO.

2. Verify Patch Status: After patching, run the detection scripts provided above again to ensure version numbers have been updated to the secure, fixed versions.

3. Restrict Local Access: Since the vulnerability allows for local code execution, strictly limit physical and logical access to the servers hosting PME or EPO. Ensure that only authorized administrators have local login rights.

4. Review Administrative Privileges: Ensure that accounts used to operate these systems do not have unnecessary administrative privileges on the underlying OS. Implement the Principle of Least Privilege (PoLP) to limit the blast radius if an account is compromised.

5. Network Segmentation: Ensure that OT (Operational Technology) networks hosting these systems are properly segmented from the IT network. This prevents lateral movement from a compromised IT system to critical power management infrastructure.

Related Resources

Security Arsenal Alert Triage Automation AlertMonitor Platform Book a SOC Assessment platform Intel Hub