An improper control of code generation flaw allows a maliciously crafted TGML graphics file to cause the EcoStruxure Building Operation application to execute unintended code. The vulnerability can lead to arbitrary code execution within the application process, potentially enabling attackers to read or modify data, hijack system controls, or compromise the host whose application generates code from TGML content.

The affected products are Schneider Electric's EcoStruxure Building Operation Webstation and Workstation. No specific version information is listed, so any deployed instance of these products that processes TGML files may be vulnerable.

The vulnerability carries a CVSS score of 7, indicating medium-to-high severity. The EPSS score is below 1 % and it is not listed in CISA's KEV catalog, suggesting that exploit activity is not widespread yet. Attackers would exploit the flaw by supplying a crafted TGML file to the application, either via a local user with file‑upload rights or potentially through a remote web interface if that capability exists. Successful exploitation could lead to full execution of untrusted code within the application, entailing significant confidentiality, integrity, and availability risks.