High severity · published Oct 8, 2024
CVE-2024-9005
CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web…
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be
remotely executed on the server when unsafely deserialized data is posted to the web server.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
EcoStruxure Power Monitoring Expert (PME) · Schneider Electric
Version 2022 and prior · source: vendor
EP
Ecostruxure Power Monitoring Expert · Schneider Electric
before 2022 · source: CISA
Affected product
EP
EcoStruxure Power Monitoring Expert (PME)
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9005
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9005
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-05.pdf
More from EcoStruxure Power Monitoring Expert (PME)
8.7
CVE-2025-54923
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted…
7.8
CVE-2025-11739
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker…
7.5
CVE-2025-54925
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a…
7.5
CVE-2025-54924
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a…
7.2
CVE-2025-54926
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker…