Summary
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ IT Data Center Expert (DCE)
product.
The EcoStruxure™ IT Data Center Expert product is a scalable monitoring software that collects, organizes,
and distributes critical device information providing a comprehensive view of equipment.
Failure to apply the remediation provided below may risk information disclosure, and remote compromise of
the offer which could result in disruption of operations and access to system data.
Details
EcoStruxure™ IT Data Center Expert is Formerly known as StruxureWare Data Center Expert
Vulnerabilities 6
-
Critical 9.5CVE-2025-50121 EPSS 22%
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exis…
-
High 8.9
A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generat…
-
High 7.2
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote comman…
-
High 7.2
A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is …
-
Medium 6.3
A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code executi…
-
Medium 5.9
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of …
Revision history
-
#1.0.0
Original Release
References
-
EcoStruxure™ IT Data Center Expert - SEVD-2025-189-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2025-189-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390
-
ICS Advisory ICSA-25-203-06 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B