CVE-2024-2602 is a path traversal in Schneider Electric FoxRTU Station that could lead to remote code execution when an authenticated user runs a saved project file tampered with by a malicious actor. Severity is High at 7.3. the fixed versions are in Schneider Electric notice SEVD-2024-191-03, which I could not retrieve, so check it.
What's affected
- Schneider Electric FoxRTU Station is the affected product. The NVD record lists the product without a version range.
- The vendor notice is SEVD-2024-191-03. The affected and fixed versions are in that notice, and I could not retrieve it, so take them from the vendor.
- The attack needs a user to open a tampered saved project file, so the CVSS vector shows local access and required user interaction.
The NVD record gives a CVSS score of 7.3 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Published 2024-07-11.
How to check if you're exposed
- Open FoxRTU Station and note its version from the About screen, or check your software inventory.
- Compare that version with the affected and fixed versions in SEVD-2024-191-03.
- Find where saved project files are stored and shared, since the risk comes from files that arrive from outside.
What to do now
- Read SEVD-2024-191-03 and apply the update or mitigation the vendor describes.
- Only open project files from sources you trust, and treat files received by email or from shared drives as untrusted.
- Keep engineering workstations that run this software segmented from the wider network.
- Record which workstations have the software, so you can confirm the update on each.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
Path traversal means a file path taken from untrusted input is not restricted to the folder it should stay in. Here the record says it could result in code execution when a tampered project file is run. The score of 7.3 reflects that exploitation needs local access and a user action, but the outcome on the workstation is high impact. Engineering workstations in industrial settings often bridge to sensitive networks, so they deserve attention even when the vector is local.
The record tags the weakness as CWE-22. See the Gold pages for more on the class.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
Because the record does not give versions, the vendor notice is the source of truth here. Write down the version you find on each workstation before you read it, so the comparison is quick.
Quick check
Can this be exploited remotely over the network?
Not directly. The CVSS vector lists local access and user interaction, because a user has to open a tampered project file. The file itself can still arrive over email or a share.
Sources
I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.
Last reviewed: 19 October 2026.
