CVE-2026-2273

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-2273
CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of the subsequent system when an authenticated user opens a malicious project file.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-04.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:schneider-electric:ecostruxure_automation_expert:*:*:*:*:*:*:*:*
History

23 Jun 2026, 13:53

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.2
CPE cpe:2.3:a:schneider-electric:ecostruxure_automation_expert:*:*:*:*:*:*:*:*
First Time Schneider-electric ecostruxure Automation Expert
Schneider-electric
References () https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-04.pdf - () https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-04.pdf - Vendor Advisory

17 Jun 2026, 10:30

Type Values Removed Values Added
Summary
  • (es) CWE-94: Existe una vulnerabilidad de Control inadecuado de la generación de código ('Inyección de código') que podría causar la ejecución de comandos no confiables en la estación de trabajo de ingeniería, lo que podría resultar en un compromiso limitado de la estación de trabajo y una posible pérdida de Confidencialidad, Integridad y Disponibilidad del sistema subsiguiente cuando un usuario autenticado abre un archivo de proyecto malicioso.

10 Mar 2026, 18:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:18

Updated : 2026-06-23 13:53

NVD link : CVE-2026-2273

Mitre link : CVE-2026-2273

CVE.ORG link : CVE-2026-2273

JSON object : View

Products Affected

schneider-electric

  • ecostruxure_automation_expert
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')