EUVD-2021-9934

Malicious code in bioql PyPI...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS advisories on September 23, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-266-01 AutomationDirect CLICK PLUS ICSA-25-266-02 Mitsubishi Electric MELSEC-Q Serie...

Schneider Electric SESU backend link vulnerability

Schneider Electric SESU is a module for optimizing the efficiency of energy usage from Schneider Electric France. A backlink vulnerability exists in Schneider Electric SESU that stems from improper link resolution and could result in elevation of privilege or denial of service...

CVE-2019-6834

The vulnerability CVE-2019-6834 affects Schneider Electric Software Update (SESU) SUT Service component versions 2.1.1 through 2.3.0. It is a CWE-502 Deserialization of Untrusted Data flaw that could allow an attacker to execute arbitrary code with SYSTEM privileges when placing a malicious user ...

CVE-2019-6834: Deserialization of Untrusted Data

A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted system with SYSTEM privileges when placing a malicious user to be authenticated for this vulnerability to be successfully exploited. Affected Product: Schneide...

CVE-2021-22799

A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password from the registry. Affected Product: Schneider Electric Software Update, V2.3.0 through V2.5.1...

CVE-2021-22799

A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password from the registry. Affected Product: Schneider Electric Software Update, V2.3.0 through V2.5.1...

CVE-2021-22799

Schneider Electric Software Update (SESU) versions 2.3.0–2.5.1 are affected by CWE-331 (Insufficient Entropy). The vulnerability could allow an attacker who decrypts the SESU proxy password stored in the registry to trigger an unintended connection from an internal network to an external network....

CVE-2021-22799: Insufficient Entropy

A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password from the registry. Affected Product: Schneider Electric Software Update, V2.3.0 through V2.5.1...

Schneider Electric SESU

1. EXECUTIVE SUMMARY CVSS v3 3.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Schneider Electric Software Update SESU Vulnerability: Insufficient Entropy 2. RISK EVALUATION Successful exploitation of this vulnerability could cause unintended connection from an internal...

Open redirect

A CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability exists in Schneider Electric Software Update SESU, V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on...

CVE-2020-7520

Schneider Electric Software Update (SESU)

CVE-2020-7520

A CWE-601: URL Redirection to Untrusted Site 'Open Redirect' vulnerability exists in Schneider Electric Software Update SESU, V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on...

PT-2020-6367

Name of the Vulnerable Software and Affected Versions Schneider Electric Software Update SESU versions 2.4.0 and prior Description A URL redirection to untrusted site issue exists, which could lead to the execution of malicious code on the victim's machine. To exploit this, an attacker needs...

PT-2019-5949

Name of the Vulnerable Software and Affected Versions Schneider Electric Software Update SESU SUT Service component versions V2.1.1 through V2.3.0 Description A Deserialization of Untrusted Data issue exists, which could allow an attacker to execute arbitrary code on the targeted system with SYST...

CVE-2018-7799

CVE-2018-7799 corresponds to a DLL hijacking vulnerability in Schneider Electric Software Update (SESU) prior to v2.2.0. The issue is classified as CWE-427 Uncontrolled Search Path Element and can allow an attacker with local access to place a crafted DLL and execute arbitrary code on the target ...

CVE-2013-0655

The client in Schneider Electric Software Update SESU Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80...

CVE-2013-0655

The CVE-2013-0655 issue affects Schneider Electric Software Update (SESU) Utility, specifically versions 1.0.x and 1.1.x. The root cause is that the SESU client does not verify the origin of updates, enabling a man-in-the-middle to spoof updates by tampering with the data stream over TCP port 80,...

PT-2013-2505

Name of the Vulnerable Software and Affected Versions Schneider Electric Software Update SESU Utility versions 1.0.x through 1.1.x Description The issue allows man-in-the-middle attackers to spoof updates and execute arbitrary code by modifying the data stream on TCP port 80, due to the client no...

CVE-2013-0655: Improper Input Validation

The client in Schneider Electric Software Update SESU Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80...