Unpatched Buffer Overflow in Schneider Home Devices

When the lights start flickering in homes equipped with Schneider Electric end-of-life smart switches, it could be hackers, now that the French company disclosed a remotely exploitable vulnerability that won’t receive a patch.

See Also: Cracking the Code: Securing Machine Identities

A flaw in Schneider Wiser Home Automation devices lets attackers inject code or bypass authentication, tracked as CVE-2023-4041, carries a CVSS v4 base score of 9.3. It’s a buffer overflow vulnerability that stems from improper size checking during input copy operations, enabling code injection during firmware updates. It affects Wiser AvatarOn 6K Freelocate and Wiser Cuadro H 5P Socket products – all of which are at end of life, leading Schneider to advise customers to either disable the firmware update function or replace the products.

These devices are not core to industrial automation systems but they often exist on the same networks and can serve as entry points for lateral movement or surveillance.

Schneider reported the issue to the U.S. Cybersecurity and Infrastructure Security Agency. No hacking has been reported to date but the ease of attack and its ability to be exploited remotely raise concerns for asset owners in energy and commercial sectors, CISA warned.

The French multinational promotes Wiser-brand smart switches as a way of controlling electric switches connected to lights, air conditioners, televisions and appliances from a smartphone.

The vulnerable stems from how a bootloader made by Silicon Labs allows firmware updates to be parsed without integrity checks. That opens the door for attackers to inject unauthorized code, potentially bypassing authentication and gaining control of targeted devices.

CISA recommends isolating such systems behind firewalls, minimizing network exposure and using secure remote access methods such as VPNs.

Separately, Schneider Electric’s EcoStruxure Power Build Rapsody platform is also vulnerable to a stack-based buffer overflow. The flaw, tracked as CVE-2025-3916, can be exploited by attackers to execute arbitrary code via a malicious project file – a SSD file – but it requires user interaction and local access.

The CVSS v4 score for this vulnerability is 4.6. Schneider has released a patch in version 2.8.1 FR. While less severe than the flaw in home automation devices, this vulnerability could still result in compromise if exploited by an insider or through social engineering.