The flaw allows an authenticated user to induce the workstation to execute arbitrary code when opening a crafted project file, potentially compromising confidentiality, integrity, and availability of the system.

Schneider Electric EcoStruxure Automation Expert engineering workstations are affected. No specific version range is disclosed in the advisory, so all deployed installations of the product should be examined. If the software version is unknown it remains significantly vulnerable.

The CVSS score of 7.2 indicates a high severity, while the EPSS score is below 1%, suggesting a low overall exploitation likelihood at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack requires an authenticated user who has permission to open project files, implying that exploitation is local and constrained to users with access to the workstation. If an attacker compromises an authenticated account or succeeds in delivering a malicious project file, they can execute arbitrary code, which may be used for subsequent actions against the system.