CVE-2023-6409 is a high severity hard-coded credentials flaw in Schneider Electric EcoStruxure Control Expert. A project file protected with an application password may be opened by someone who does not know that password. Fixed versions and mitigations are in Schneider notice SEVD-2024-044-01.
What's affected
- Product: Schneider Electric EcoStruxure Control Expert, and EcoStruxure Process Expert, per the record product list.
- Affected versions: not stated in the record. Use the table in SEVD-2024-044-01.
- Fixed version: see the vendor notice. This post does not state one.
- Impact: unauthorised access to a project file protected with an application password. Access is local and needs no privileges.
The record gives a CVSS 3.1 base score of 7.7 (high) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
Check the version of Control Expert on each engineering workstation, through the application About screen or your software inventory, and compare it with the vendor notice.
Also inventory where project files live. The flaw concerns the application password on a project file, so copies on shared drives, laptops, email and backups matter as much as the workstation.
What to do now
- Inventory engineering workstations and the project files they hold.
- Read Schneider notice SEVD-2024-044-01 and install the listed update or follow its mitigations.
- Do not treat an application password as the only control on a project file. Store project files in locations with their own access control and encryption.
- Review recent access to shared project file locations.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-798 (Use of Hard-coded Credentials): A fixed credential is built into the product, so anyone who learns it can use it against every installation.
A hard-coded credential is a secret placed in the product itself. Because it is the same everywhere, anyone who learns it can use it against every copy, and a user cannot rotate it.
Project files for controllers hold logic that defines how a plant behaves. Reading them can reveal process detail, and changing them can matter more. The vector shows local access with no privileges, so the main concern is stolen or leaked files and shared workstations. File level controls outside the application password give you protection that does not depend on the vendor fix.
Quick check
Is the password in the project file or the application?
The record says the credentials are hard-coded in a way that lets protected project files be opened. Read the vendor notice for the exact mechanism.
Is this remotely exploitable?
The vector is local. An attacker needs the project file or the workstation.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
