Untrusted project-file deserialization can enable remote code execution in Schneider Electric EcoStruxure Power Design - Ecodial

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user.

• Schneider Electric EcoStruxure Power Design - Ecodial NL: all versions are identified as affected.
• Schneider Electric EcoStruxure Power Design - Ecodial INT: all versions are identified as affected.
• Schneider Electric EcoStruxure Power Design - Ecodial FR: all versions are identified as affected.

The record and vendor notice do not identify an exact fixed release. The status of other branches or products is not established by the available evidence.

This is a CWE-502 flaw in the handling of serialized project-file data. The attacker-controlled input is a malicious project file that is processed when a valid user loads it into the application. The record classifies the attack as local, with low complexity, no privileges required, and user interaction required. If unsafe deserialization reaches the vulnerable execution condition, the application could execute code remotely on the workstation running it. The available evidence does not disclose the serialization format, vulnerable code path, payload structure, or the internal processing sequence that leads to code execution.

Exploitation requires a malicious project file to be loaded into the application by a valid user, so user interaction is required. The record classifies the attack vector as local and does not require prior privileges. The available evidence does not establish a directly reachable network service for this flaw. The supplied record does not identify a public exploit or provide confirmed exploitation details; this does not prove that exploitation has never occurred.

Successful exploitation could enable code execution on a workstation running EcoStruxure Power Design - Ecodial, with potential effects on the confidentiality, integrity, and availability of data or resources accessible to the application process. Possible consequences include reading design data, altering project files, or disrupting workstation operations. The described scope is unchanged, but the available evidence does not establish privilege escalation beyond the application context or movement to other systems. Loading the file by a user is an explicit condition of the vulnerability description.

If exploitation succeeds, attacker-controlled code could run on a workstation used for electrical project design. This could expose or modify project files and other data accessible to the application, and could disrupt the workstation or design workflow. Actual risk depends on the account context of the application, local data access, and the trustworthiness of file-exchange channels. The available evidence does not identify a specific breach, victim, or campaign.

1. Do not open untrusted project files. Open project files only from trusted sources and verify their integrity before use.
2. Compute a hash for project files, regularly check hash consistency, and store the hash information separately from the project file.
3. When sharing or receiving files, exchange the hash information through a separate out-of-band channel.
4. Use secure communication protocols when exchanging files over a network.
5. Harden the workstation running the application and remove accounts that no longer need access, following the principle of least privilege.
6. The vendor states that a remediation plan for future releases will include a fix, but the available evidence does not identify an exact fixed release. Monitor subsequent Schneider Electric security notices before treating an upgrade as complete remediation.

1. Inventory workstations running EcoStruxure Power Design - Ecodial and identify whether they use the NL, INT, or FR variant, together with their version status.
2. Identify project files loaded into the application, their sources, and the users who opened them.
3. Where the organization maintains hash information separately, compare project-file hashes before use and investigate unexpected changes.
4. Review endpoint telemetry around application file-opening activity for unexpected process execution or file changes. Treat this as precautionary monitoring, not as a vendor-confirmed indicator of compromise.
5. Do not treat the absence of alerts or suspicious events as proof that a system is safe.