CISA 2026-05-20

Schnieider Electric EcoStruxure Machine Expert HVAC (SEVD-2026-132-01)

CVE-2026-6332

Machine-generated analysis · WAYSCloud LLM

The advisory states that versions of EcoStruxure Machine Expert HVAC prior to 1.10.0 store sensitive information in cleartext, potentially exposing protected source code during editing or compiling.

Context

EcoStruxure Machine Expert HVAC is a programming software for Modicon M171-M172 logic controllers, according to the advisory. The advisory identifies a cleartext storage of sensitive information vulnerability (CVE-2026-6332) that could lead to loss of confidentiality if an authorized attacker accesses the source code. The affected product is used in critical infrastructure sectors including energy, water and wastewater, chemical, and critical manufacturing. Deployment is reported as worldwide.

Operator considerations

Check: Inventory installations of EcoStruxure Machine Expert HVAC to identify versions prior to 1.10.0.
Patch: Upgrade to version 1.10.0 or later, which includes a fix for the vulnerability.
Log: Monitor access to source code files within the software environment if logging capabilities are available and specified in the implementation.

From Cybersecurity and Infrastructure Security Agency ↗

Schneider Electric is aware of a vulnerability in its EcostruxureTM Machine Expert HVAC product. The [EcostruxureTM Machine Expert HVAC](https://www.se.com/ww/en/download/document/EcoStruxureME_HVAC/) product is a programming software for Modicon M171-M172 logic controllers. Failure to apply the remediation provided below may risk in revealing sensitive information, which could result in disclosing protected source code, leading to loss of confidentiality.

The following versions of Schnieider Electric EcoStruxure Machine Expert HVAC (SEVD-2026-132-01) are affected:

Ecostruxure™ Machine Expert HVAC vers

Read the full advisory on CISA →