EcoStruxure™ IT Data Center Expert vulnerabilities
4 known vulnerabilities in EcoStruxure™ IT Data Center Expert from Schneider Electric. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
EcoStruxure™ IT Data Center Expert: Improper Privilege Management
A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script.
- 7.2 High severity
EcoStruxure™ IT Data Center Expert: Improper Control of Generation of Code
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input.
- 8.9 High severity
EcoStruxure™ IT Data Center Expert: Insufficient Entropy
A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts.
- 9.5 Critical severity
EcoStruxure™ IT Data Center Expert: Improper Neutralization of Special Elements used in an OS Command
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP i