CVE-2024-2602: Schneider Electric FoxRTU Station RCE Vulnerability

CVE-2024-2602 Overview

CVE-2024-2602 is a path traversal vulnerability [CWE-22] affecting Schneider Electric Foxrtu Station. The flaw allows remote code execution when an authenticated user opens a saved project file that has been tampered with by a malicious actor. Exploitation requires user interaction and local access to the host running the engineering software.

Schneider Electric published security notice SEVD-2024-191-03 to address the issue. The vulnerability affects industrial control system (ICS) engineering workflows where operators exchange or restore project files across sites.

Critical Impact
A crafted project file can trigger arbitrary code execution in the security context of the engineer opening the file, enabling full compromise of the engineering workstation.

Affected Products

Schneider Electric Foxrtu Station (see vendor advisory SEVD-2024-191-03 for exact affected versions)
Engineering workstations running Foxrtu Station used to author or open .project files
ICS/SCADA environments using SCADAPack RTUs configured via Foxrtu Station

Discovery Timeline

2024-07-11 - CVE-2024-2602 published to NVD
2024-07-11 - Schneider Electric published security notice SEVD-2024-191-03
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2602

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory when Foxrtu Station processes saved project files. An attacker who can modify a project file before it is opened can embed traversal sequences that cause the application to read from or write to arbitrary locations on the local file system.

Because project files are typically shared between engineers and stored on removable media or network shares, they present a practical delivery vector in operational technology (OT) environments. Successful exploitation executes code in the context of the authenticated user, which on engineering workstations often carries privileges to reconfigure connected RTUs.

The attack requires local execution and user interaction, but no prior privileges on the target host. Confidentiality, integrity, and availability of the workstation are all at risk following successful exploitation.

Root Cause

Foxrtu Station does not correctly canonicalize or restrict file paths referenced inside project files. Path components such as ..\ traversal sequences are honored during file operations, allowing references to resolve outside the intended project directory.

Attack Vector

An attacker crafts or modifies a legitimate Foxrtu Station project file to include malicious path references. The file is delivered to an engineer via email, shared drive, USB media, or a compromised project repository. When the engineer opens the tampered project, Foxrtu Station follows the embedded paths and writes or executes attacker-controlled content, resulting in code execution on the workstation.

No verified public exploit code is available for CVE-2024-2602. See the Schneider Electric Security Notice SEVD-2024-191-03 for vendor-supplied technical details.

Detection Methods for CVE-2024-2602

Indicators of Compromise

Foxrtu Station project files originating from untrusted sources or unexpected email attachments
Unexpected child processes spawned by the Foxrtu Station executable, including cmd.exe, powershell.exe, or rundll32.exe
File writes by the Foxrtu Station process to locations outside its configured project directory, such as %APPDATA%, %TEMP%, or system startup folders
New persistence entries (Run keys, scheduled tasks, services) created shortly after a project file was opened

Detection Strategies

Alert on process-lineage anomalies where Foxrtu Station is the parent of interpreters or scripting hosts
Inspect project files at rest for path traversal sequences (..\, ../, absolute paths) referenced inside file resources
Correlate file-open events on .project files with subsequent outbound network connections from the engineering workstation

Monitoring Recommendations

Log and retain endpoint process-creation and file-write telemetry from all engineering workstations running Foxrtu Station
Monitor removable media and file-share activity that delivers project files into the OT environment
Track user accounts that regularly open project files and baseline their normal application behavior for deviation

How to Mitigate CVE-2024-2602

Immediate Actions Required

Apply the remediation described in Schneider Electric security notice SEVD-2024-191-03 to all Foxrtu Station installations
Restrict Foxrtu Station usage to dedicated engineering workstations that are network-segmented from business IT
Only open project files received from trusted, verified sources and validate file integrity before use
Run Foxrtu Station under a standard user account rather than a local administrator

Patch Information

Schneider Electric addressed CVE-2024-2602 in the update referenced by Schneider Electric Security Notice SEVD-2024-191-03. Review the notice for fixed versions and any interim mitigations that apply to specific product configurations.

Workarounds

Store project files on access-controlled repositories with integrity checks such as cryptographic signing or hashing
Disable or restrict use of removable media on engineering workstations to reduce the delivery surface
Apply application allow-listing so Foxrtu Station cannot spawn scripting hosts or unapproved binaries
Segment engineering workstations from corporate email and general internet access to reduce exposure to tampered files

bash

# Example: enumerate suspicious traversal patterns inside Foxrtu project files
# Run on a controlled analysis workstation, not the production engineering host
grep -RIE '\.\.[\\/]' /path/to/project/files/