CVE-2024-8422: Zelio Soft 2 Use After Free Vulnerability

CVE-2024-8422 Overview

CVE-2024-8422 is a Use After Free vulnerability [CWE-416] in Schneider Electric Zelio Soft 2, a programming software used to configure Zelio Logic smart relays. The flaw is triggered when a user opens a specially crafted Zelio Soft 2 project file. Successful exploitation can lead to arbitrary code execution, denial of service, and loss of confidentiality and integrity on the affected workstation. The vulnerability requires local access and user interaction, but no privileges are needed to attempt exploitation.

Critical Impact
A malicious project file can execute arbitrary code in the context of the Zelio Soft 2 user, compromising engineering workstations used to program industrial smart relays.

Affected Products

Schneider Electric Zelio Soft 2 (all versions prior to the vendor-issued fix)
Engineering workstations running Zelio Soft 2
Industrial control environments using Zelio Logic smart relays configured via Zelio Soft 2

Discovery Timeline

2024-10-08 - CVE-2024-8422 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8422

Vulnerability Analysis

CVE-2024-8422 is classified as a Use After Free condition [CWE-416] in the Zelio Soft 2 project file parser. The application dereferences memory that has already been released during the handling of crafted project file content. Once the freed memory is reused by attacker-controlled data, the process can be steered into executing arbitrary instructions or entering an unstable state that terminates the program.

Schneider Electric identifies impacts spanning arbitrary code execution, denial of service, and loss of confidentiality and integrity. This aligns with the high impact ratings across all three security properties. Exploitation is local and requires the victim to open a malicious .zm2 or related Zelio Soft 2 project file.

Root Cause

The root cause is improper lifetime management of an object referenced during project file deserialization. The parser retains and later dereferences a pointer after the underlying memory has been freed, allowing attacker-influenced heap contents to be interpreted as a valid object.

Attack Vector

An attacker crafts a malicious Zelio Soft 2 project file and delivers it to an engineer through phishing, shared drives, USB media, or supply chain channels. When the target opens the file in Zelio Soft 2, the corrupted parsing path triggers the use-after-free, giving the attacker control over execution in the user's context. No authentication to the application is required, only user interaction to open the file. Refer to the Schneider Electric Security Notice for vendor technical details.

Detection Methods for CVE-2024-8422

Indicators of Compromise

Unexpected child processes spawned by the Zelio Soft 2 executable, particularly command interpreters such as cmd.exe or powershell.exe.
Zelio Soft 2 process crashes or exceptions logged in Windows Event Viewer shortly after a project file is opened.
Zelio Soft 2 project files arriving from untrusted email attachments, external media, or shared network locations.
Outbound network connections initiated by the Zelio Soft 2 process, which normally operates offline on engineering workstations.

Detection Strategies

Monitor engineering workstations for process-injection patterns and anomalous memory allocations within the Zelio Soft 2 process.
Alert on file writes or executable drops in user-writable directories following the opening of a Zelio Soft 2 project file.
Correlate Zelio Soft 2 crash events with subsequent process creation activity to identify successful exploitation attempts.

Monitoring Recommendations

Enable full command-line and process-tree logging on operational technology (OT) engineering workstations.
Track project file transfers into ICS environments and flag files originating from outside approved engineering repositories.
Review endpoint telemetry for behavioral anomalies tied to Zelio Soft 2, including unusual DLL loads and heap corruption indicators.

How to Mitigate CVE-2024-8422

Immediate Actions Required

Apply the remediation guidance published in Schneider Electric advisory SEVD-2024-282-06 as soon as it is available for your version.
Restrict Zelio Soft 2 to trusted engineering workstations and remove it from general-purpose user endpoints.
Train engineers to open project files only from verified internal sources and to validate file origin before execution.

Patch Information

Schneider Electric published security notice SEVD-2024-282-06 describing the vulnerability and mitigation guidance. Consult the Schneider Electric Security Notice for the current fixed version and vendor-recommended remediation steps.

Workarounds

Isolate engineering workstations running Zelio Soft 2 on segmented OT networks with strict inbound and outbound controls.
Enforce application allowlisting so only signed and approved binaries can execute on ICS engineering hosts.
Scan all Zelio Soft 2 project files with endpoint security tooling before opening them, and quarantine files from untrusted senders.
Operate Zelio Soft 2 under a standard user account rather than an administrator to limit post-exploitation impact.

bash

# Example: block Zelio Soft 2 project files received via email on a Windows host
# Adjust extension list to match your Zelio Soft 2 project file conventions
New-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Restrict execution location for Zelio Soft 2 project files via AppLocker file screen
fsutil behavior set SymlinkEvaluation R2R:0