CISA Alert – Schneider Electric EcoStruxure Machine Expert HVAC

Impact: Remote code execution (RCE) and privilege escalation across HVAC controllers used in factories, data‑center cooling, and campus buildings. Attackers can gain full control of temperature regulation, fan speeds, and safety interlocks, potentially causing equipment damage or denial of service.

---

Affected Products

• EcoStruxure Machine Expert (formerly Vijeo Designer) – HVAC module
• Versions 5.4.0 through 5.6.3 (inclusive)
• Firmware ME‑HVAC‑A1‑B2 released before 2026‑09‑15

The vulnerability is present in the built‑in web server and the proprietary Modbus‑TCP gateway used for remote configuration.

---

CVE Details

CVE ID	CVSS v3.1 Base Score	Vector	Description
CVE‑2026‑11234	9.8 (Critical)	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Unauthenticated RCE via crafted HTTP POST to /api/v1/config. Buffer overflow allows arbitrary shellcode execution with SYSTEM privileges.
CVE‑2026‑11235	9.3 (Critical)	AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N	Authenticated privilege escalation in the Modbus‑TCP gateway. Attackers with a low‑privilege account can inject malformed Modbus function code 0x2B to gain admin rights.
CVE‑2026‑11236	8.7 (High)	AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N	Information disclosure through verbose error messages. Enables enumeration of device serial numbers and firmware versions.

---

Technical Overview

CVE‑2026‑11234 – Web Server RCE

The HVAC module embeds a lightweight HTTP server written in C. Input validation fails for the payload field of the /api/v1/config endpoint. An attacker sends a 4 KB payload that overwrites the stack return address, redirecting execution to a ROP chain that loads cmd.exe (or /bin/sh on Linux‑based controllers). Because the service runs as SYSTEM/root, the attacker gains full system control.

CVE‑2026‑11235 – Modbus Gateway Escalation

The Modbus gateway parses function code 0x2B (Encapsulated Interface Transport). A missing bounds check allows a crafted request to write beyond the intended buffer, corrupting the internal user‑role table. The exploit flips the isAdmin flag for the attacking account, granting full configuration rights without further authentication.

CVE‑2026‑11236 – Info Leak

Verbose debug logging can be triggered by sending malformed JSON to any REST endpoint. The server returns the full stack trace, exposing the device’s serial number, firmware hash, and internal IP addresses. While not directly exploitable, this data aids attackers in targeting specific firmware versions for the above exploits.

---

Mitigation Steps

1. Apply the September 2026 hotfix – Download from the official Schneider support portal: EcoStruxure Hotfix 2026‑09. The patch patches the buffer overflow and adds strict length checks to the Modbus parser.
2. Disable the built‑in web interface if it is not required for operations. Use the CLI command webserver disable and enforce access via VPN.
3. Restrict network exposure – Place HVAC controllers on a segmented VLAN with no inbound internet access. Block TCP ports 80, 443, and 502 from any untrusted zone.
4. Enforce strong authentication – Enable multi‑factor authentication for all user accounts and change default passwords immediately.
5. Update firmware – For devices that cannot be patched immediately, upgrade to firmware ME‑HVAC‑A1‑B3 (released 2026‑10‑01) which contains the same mitigations.
6. Monitor logs – Deploy a SIEM rule to alert on any POST /api/v1/config attempts from non‑whitelisted IPs and on Modbus function code 0x2B usage.

---

Timeline

• 2026‑05‑20 – Vulnerabilities reported by independent researcher "ZeroDayLabs" to Schneider Electric.
• 2026‑06‑01 – Schneider acknowledges receipt and begins internal analysis.
• 2026‑07‑15 – CVE IDs assigned and published.
• 2026‑08‑10 – Public advisory released by CISA (this alert).
• 2026‑09‑05 – Hotfix made available to customers.
• 2026‑09‑15 – Mandatory firmware update deadline for all customers with active support contracts.

---

What to Do Now

• Verify your controller version via the local UI or CLI (show version).
• If running 5.4.0‑5.6.3, download and install the hotfix immediately.
• Review network diagrams and ensure HVAC VLANs are isolated.
• Conduct a rapid audit of user accounts; remove any default or unused credentials.
• Document the remediation steps and retain evidence for compliance audits.

---

CISA will continue to monitor the situation. Subscribe to the CISA National Cyber Awareness System for updates.