Schneider Electric EcoStruxure Data Center Expert
Schneider Electric is aware of a hard-coded credentials vulnerability in its EcoStruxure IT Data Center Expert (DCE) product that requires administrator credentials and enabling a feature (SOCKS Proxy) that is off by default. The EcoStruxure IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment. Failure to apply the remediation provided below may risk information disclosure, and remote compromise of the offer which could result in disruption of operations and access to system data.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-13957US | —OT erhöht | — | ||
CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credent… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Use of Hard-coded Credentials vulnerability in EcoStruxure IT Data Center Expert - SEVD-2026-069-05 PDF Versionself
- Use of Hard-coded Credentials vulnerability in EcoStruxure IT Data Center Expert - SEVD-2026-069-05 CSAF Versionself
- ICS Advisory ICSA-26-076-03 JSONself
- ICS Advisory ICSA-26-076-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (2)
- MitigationEcoStruxure IT Data Center Expert
If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Harden the DCE instance according to the cybersecurity best practices documented in the EcoStruxure IT Data Center Expert Security Handbook • Ensure the SOCKS Proxy is disabled as in the default configuration.
https://community.se.com/t5/DCE-Security/EcoStruxure-IT-Data-Center-Expert-Security-Handbook/ta-p/446553 - BehobenEcoStruxure IT Data Center Expert
v9.1 of EcoStruxure IT Data Center Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/en/product-range/61851-ecostruxure-it-data-center-expert/#software-and-firmware
https://www.se.com/en/product-range/61851-ecostruxure-it-data-center-expert/#software-and-firmware
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan