CISA Issues New ICS Advisory for Schneider Electric EcoStruxure Power Monitoring Expert

The Cybersecurity and Infrastructure Security Agency (CISA) released an Industrial Control Systems (ICS) advisory on March 27, 2025, addressing vulnerabilities in Schneider Electric’s EcoStruxure Power Monitoring Expert (PME). This advisory, labeled ICSA-25-037-01 (Update A), provides technical details and mitigation steps for a newly identified security flaw affecting critical infrastructure systems¹.

Summary for Security Leaders

This advisory follows a pattern of increasing ICS vulnerability disclosures, with CISA publishing 8 advisories in January 2025 alone⁹. The Schneider Electric PME vulnerability could allow unauthorized access to power monitoring systems, potentially disrupting operational technology (OT) environments. Immediate review and patching are recommended.

Advisory ID: ICSA-25-037-01 (Update A)
Affected Product: Schneider Electric EcoStruxure Power Monitoring Expert
Risk Level: Not yet CVSS-scored (awaiting vendor assessment)
Mitigation: Apply Schneider Electric’s security update

Technical Details

The advisory describes a vulnerability in PME’s web interface that could be exploited remotely. While CISA hasn’t disclosed specific exploit vectors, historical ICS advisories suggest common issues like improper input validation or authentication bypass^{5, 7}. Schneider Electric has released Update A to address this flaw, marking the second revision to this advisory since its initial publication.

Industrial control systems like PME are particularly sensitive targets due to their role in managing physical infrastructure. A 2024 report showed ICS vulnerabilities increased by 32% compared to 2023, with power systems being the second most affected sector^{1, 9}.

Historical Context

CISA’s ICS advisories have followed an irregular pattern, with spikes in October 2024 (10 advisories) and January 2025 (8 advisories)^{7, 9}. Schneider Electric products were previously addressed in:

Date	Advisory Count	Notable Vendors
March 2024	15	Multiple
July 2024	1	Rockwell Automation
January 2025	8	Multiple

Actionable Recommendations

Organizations using EcoStruxure PME should:

Apply Schneider Electric’s security update immediately
Isolate PME systems from untrusted networks
Monitor for anomalous authentication attempts
Review CISA’s ICS mitigation guidelines¹

For detection, network monitoring tools should watch for unexpected HTTP requests to PME’s web interface (default port 80/443). SIEM rules can be tuned to alert on failed login attempts exceeding threshold limits.

Conclusion

This advisory continues CISA’s focus on ICS security, particularly for energy sector systems. The increasing frequency of ICS advisories (46 in 2024 vs. 28 in 2023) suggests both growing researcher attention and vendor responsiveness⁷. Organizations should prioritize patching ICS systems due to their critical role in infrastructure operations.