CISA: Schneider Electric Plant iT/Brewmaxx Vulnerabilities Allow Remote Code Execution

CISA ICS-CERT Advisories

Published March 24th, 2026

Detected March 24th, 2026

Summary

CISA has issued an advisory regarding multiple vulnerabilities in Schneider Electric's Plant iT/Brewmaxx software, versions 9.60 and above. Successful exploitation could lead to privilege escalation and remote code execution. The advisory provides specific CVE details and mitigation steps recommended by the vendor.

View original document View source feed page

What changed

CISA has released an advisory (ICSA-26-083-03) detailing critical vulnerabilities (CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819) affecting Schneider Electric's Plant iT/Brewmaxx software, versions 9.60 and above. These vulnerabilities, including Use After Free and Integer Overflow, could allow for privilege escalation and remote code execution, posing a significant risk to critical infrastructure sectors such as Energy, Critical Manufacturing, and Commercial Facilities worldwide.

Schneider Electric recommends immediate mitigation by applying patch ProLeiT-2025-001, disabling specific Redis eval commands, and enforcing secure Redis configurations. Additionally, standard cybersecurity best practices for industrial control systems are advised, including network isolation, physical security, and secure remote access. Compliance officers should ensure these patches and configurations are implemented promptly to prevent potential exploitation and maintain operational integrity.

What to do next

Apply patch ProLeiT-2025-001 to affected Schneider Electric Plant iT/Brewmaxx systems.
Disable Redis eval commands on application servers, VisuHub, engineering workstations, and emergency mode workstations.
Implement recommended cybersecurity best practices for industrial control systems, including network isolation and secure remote access.

Source document (simplified)

ICS Advisory

Schneider Electric Plant iT/Brewmaxx

Release Date

March 24, 2026

Alert Code ICSA-26-083-03 Related topics: Industrial Control System Vulnerabilities, Industrial Control Systems View CSAF

Summary

Successful exploitation of these vulnerabilities could risk privilege escalation, which could result in remote code execution.

The following versions of Schneider Electric Plant iT/Brewmaxx are affected:

Plant iT/Brewmaxx 9.60andabove (CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819)

| CVSS | Vendor | Equipment | Vulnerabilities |
| --- | --- | --- | --- |
| v3 9.9 | Schneider Electric | Schneider Electric Plant iT/Brewmaxx | Use After Free, Integer Overflow or Wraparound, Improper Control of Generation of Code ('Code Injection') |

Background

Critical Infrastructure Sectors: Energy, Critical Manufacturing, Commercial Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: France

Vulnerabilities

Expand All +

CVE-2025-49844

The affected product uses Redis, an open-source, in-memory database. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.

View CVE Details

Affected Products

Schneider Electric Plant iT/Brewmaxx

Vendor:
Schneider Electric Product Version:
Schneider Electric Plant iT/Brewmaxx: 9.60andabove Product Status:
known_affected

Remediations

Mitigation
Schneider Electric recommends users immediately apply the following mitigations to reduce the risk of exploit:

Mitigation
Install Patch ProLeiT-2025-001 via ProLeiT Support
https://www.proleit.com/support/

Mitigation
After installing ProLeiT-2025-001, disable the eval commands in Redis on the application server, VisuHub, engineering workstations, and workstations with emergency mode functionality

Mitigation
Force usage of secure Redis configuration templates in system settings as documented in the patch manual

Mitigation
Restart all patched servers and workstations

Mitigation
Schneider Electric strongly recommends the following industry cybersecurity best practices.

Mitigation
Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.

Mitigation
Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.

Mitigation
Place all controllers in locked cabinets and never leave them in the "Program" mode.

Mitigation
Never connect programming software to any network other than the network intended for that device.

Mitigation
Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.

Mitigation
Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.

Mitigation
Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.

Mitigation
When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

Mitigation
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
https://www.se.com/us/en/download/document/7EN52-0390/

Vendor fix
For more information, see Schneider Electric security notification "SEVD-2026-013-01 Multiple Third-Party Vulnerabilities on ProLeiT Plant iT/Brewmaxx"
https://download.schneider-electric.com/files?pDocRef=SEVD-2026-013-01&penDocType=Security+and+Safety+Notice&pFile_Name=SEVD-2026-013-01.pdf

Relevant CWE: CWE-416 Use After Free

Metrics

| CVSS Version | Base Score | Base Severity | Vector String |
| --- | --- | --- | --- |
| 3.1 | 9.9 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |

CVE-2025-46817

The affected product uses Redis, an open-source, in-memory database. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution