CVE-2024-8422 is a use after free in Schneider Electric's Zelio Soft 2 programming software, scored 7.8 (High). Opening a malicious project file can lead to code execution or a crash. Schneider's notice SEVD-2024-282-06 lists versions before 5.4.2.2 as affected, and 5.4.2.2 as the fix.
What's affected
Zelio Soft 2 is the engineering tool for Zelio Logic smart relays (SR2 and SR3). Engineers use it to write LADDER or function block programs, simulate them, and upload or download them to the relay.
Schneider's notice, dated 8 October 2024, says all versions prior to 5.4.2.2 are affected. Version 5.4.2.2 contains the fix. The NVD record agrees on the High rating and the 7.8 score; there is no severity disagreement between the record and the vendor notice.
The same notice also covers CVE-2024-8518, a separate improper input validation problem scored 3.3 (Low) that can crash the application when a crafted project file is loaded. Updating to 5.4.2.2 addresses both.
The vector is local with user interaction (AV:L/AC:L/PR:N/UI:R). Nobody attacks the relay over the network here. The target is the engineer's workstation, and the lure is a project file.
How to check if you're exposed
Open Zelio Soft 2 and read the version under the Help menu's About dialog. Anything below 5.4.2.2 needs the update.
Beyond single machines, look at where project files travel. Check shared drives, email attachments, vendor exchanges and USB media used on engineering laptops. Any workstation that has Zelio Soft 2 installed and receives project files from outside the team is the exposure path.
You can also use your software inventory to list every host with the product installed. If you manage endpoints with a package inventory or SBOM tooling, query for the Zelio Soft 2 package name and version. The free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, not desktop engineering tools, so use your endpoint inventory for this one.
What to do now
- Update Zelio Soft 2 to 5.4.2.2 or later. Schneider says it can be installed through the Schneider Electric Software Update (SESU) application or downloaded from the Zelio Soft product page.
- Back up first and test the update in a development environment or on an offline machine. Schneider recommends this for every patch.
- If you cannot update yet, apply Schneider's mitigations: encrypt stored project files and limit access to trusted users, use secure protocols when sharing files over the network, and open only project files from trusted sources.
- Compute and compare hashes of project files so you can detect tampering before use.
- Keep control networks behind firewalls, away from the business network and the internet, as the general recommendations in the notice say.
Why it matters
The weakness is CWE-416, use after free. The program keeps using memory after it has been released, and a crafted file can steer what happens next. Schneider describes the possible results as arbitrary code execution, denial of service, and loss of confidentiality and integrity.
File parsers in engineering tools are a classic place for this class of bug, because the tools read complex binary formats and are trusted by the people who run them. The usual path is not a direct attack on a controller. It is a project file that arrives from a colleague, a contractor or a download, and gets opened on a workstation that can reach the plant network.
The record does not mark this CVE as known exploited. Schneider's notice credits the finding to a researcher working with Trend Micro's Zero Day Initiative, and it does not claim attacks in the wild. Treat the update as routine but prompt hygiene for any site that exchanges project files.
Quick check
Can this be exploited over the network without a file?
Not according to the vector. It requires a user to open a malicious project file, so the delivery step is the file itself.
Which version fixes it?
Schneider Electric lists Zelio Soft 2 version 5.4.2.2 as the release that includes the fix.
Sources
Last reviewed: 19 October 2026.
