Summary
Schneider Electric is aware of multiple vulnerabilities in its Data Center Expert product.
The Data Center Expert product provides an efficient way for organizations to monitor and manage their company-wide multi-vendor physical infrastructure, including power, cooling, security and environmental.
Failure to apply the remediations provided below may risk unauthorized access to a DCE instance, which could result in downtime or outage.
Vulnerabilities 4
-
High 8.0
A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE inst…
-
High 8.0
A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE…
-
High 8.0
A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE inst…
-
High 7.1
A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the …
Revision history
-
#2
Affected versions updated to include V7.9.0, remediation guidance updated for clarity.
-
#1
Original Release
References
-
Data Center Expert - SEVD-2022-165-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-165-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-04.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/