Description
CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an attacker with a Data Center Expert user account submits crafted XML payloads to SOAP service endpoints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | EcoStruxure™ IT Data Center Expert | v9.1.1 and Prior | — |
Advisories 2
- ICSA-26-181-03 Schneider Electric EcoStruxure IT Data Center Expert CISA ICS & IT advisories · Jun 30, 2026
- SEVD-2026-160-01 Improper Restriction of XML External Entity Reference vulnerability on the EcoStruxure™ IT Data Center Expert Schneider Electric CPCERT · Jun 9, 2026