1. EXECUTIVE SUMMARY

CVSS v3 6.9
ATTENTION: Exploitable remotely
Vendor: Schneider Electric
Equipment: System Monitor Application
Vulnerability: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to execute untrusted code.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Schneider Electric reports the following products are affected:

System Monitor application in Harmony Industrial PC series: All versions
System Monitor application in Pro-face Industrial PC series: All versions

3.2 Vulnerability Overview

3.2.1 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing

CVE-2020-11023 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.9 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: France

3.4 RESEARCHER

Schneider Electric CPCERT reported this vulnerability to CISA.

4. MITIGATIONS

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

Schneider Electric System Monitor application in Harmony Industrial PC series: Users can uninstall System Monitor application using the installer available for download here.
Please follow the steps described in the guideline attached as a PDF in the downloaded uninstaller guide.
Schneider Electric System Monitor application in Harmony Industrial PC series: If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
- Stop the system monitor if not required by turning off the services as specified in the Harmony Industrial PC Series User Manual.
- Set up network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.
Schneider Electric System Monitor application in Pro-face Industrial PC series: Users can uninstall System Monitor application using the installer available for download here
Please follow the steps described in the guideline attached as a PDF in the downloaded uninstaller guide.
Schneider Electric System Monitor application in Pro-face Industrial PC series: If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
- Stop the system monitor if not required by turning off the services as specified in the Pro-face PS5000 legacy industrial PC Series User Manual.
- Set up network segmentation and implement a firewall to block all unauthorized access to configured HTTP/HTTPS ports.

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-189-02 System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs - SEVD-2025-189-02 PDF Version, System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs - SEVD-2025-189-02 CSAF Version.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.

5. UPDATE HISTORY

July 22, 2025: Initial Republication of Schneider Electric CPCERT SEVD-2025-189-02