EP
Product
EcoStruxure™ Power Monitoring Expert
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 9Medium 7Low 0
Watch
Add EcoStruxure™ Power Monitoring Expert to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-5391 | 9.8 | Oct 4 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted… Affected: All versions – prior to application of Hotfix-145271 |
| CVE-2023-28003 | 8.8 | Apr 18 | A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijacked session in PME after the legitimate… Affected: All through PME 2022 |
| CVE-2022-22727 | 8.8 | Feb 4 | A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or… Affected: through 2020 |
| CVE-2021-22827 | 8.8 | Jan 28 | A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload Affected: through 9.0 |
| CVE-2021-22826 | 8.8 | Jan 28 | A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload Affected: through 9.0 |
| CVE-2020-7547 | 8.8 | Dec 1 | A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)… Affected: 7.0; 8.0; 9.0 |
| CVE-2025-11739 | 7.8 | Mar 10 | CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker… Affected: 2022; 2023; 2023; 2024; 2024 |
| CVE-2024-2229 | 7.8 | Mar 18 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user Affected: 0 |
| CVE-2024-9005 | 7.3 | Oct 8 | CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web… Affected: before 2022 |
| CVE-2020-7545 | 7.2 | Dec 1 | A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)… Affected: 7.0; 8.0; 9.0 |
| CVE-2022-22726 | 6.5 | Feb 4 | A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system… Affected: through 2020 |
| CVE-2023-5987 | 6.1 | Nov 15 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross site scripting… Affected: 2020; 2020; 2020; 2021; 2021 |
| CVE-2023-5986 | 6.1 | Nov 15 | A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack Affected: 2020; 2020; 2020; 2021; 2021 |
| CVE-2018-7797 | 6.1 | Dec 17 | A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions),… Affected: 8.2; 9.0 |
| CVE-2022-22804 | 5.4 | Feb 4 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker to view data, change… Affected: through 2020 |
| CVE-2020-7546 | 5.4 | Dec 1 | A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security… Affected: 7.0; 8.0; 9.0 |
| CVE-2025-6788 | 5.3 | Jul 11 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with… Affected: 2023 before All; 2023 R2 before All; 2024 before All; 2024 R2 before All |
Showing 17