Summary
Schneider Electric is aware of multiple vulnerabilities in its StruxureWare Data Center Expert (DCE) product. This product was recently renamed to EcoStruxure™ IT Data Center Expert.
EcoStruxure™ IT Data Center Expert is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment.
Failure to apply the remediations provided below may risk remote access and/or local privilege escalation, which could result in loss of control and loss of availability of the appliance.
Vulnerabilities 4
-
High 8.8
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerabil…
-
High 8.8
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerabil…
-
Medium 6.8
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code e…
-
Medium 6.8
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code e…
Revision history
-
#1
Original Release
References
-
StruxureWare Data Center Expert - SEVD-2023-192-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-192-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/