StruxureWare Data Center Expert vulnerabilities
10 known vulnerabilities in StruxureWare Data Center Expert from Schneider Electric. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
StruxureWare Data Center Expert: Improper Control of Generation of Code
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored.
- 7.2 High severity
StruxureWare Data Center Expert: Improper Control of Generation of Code
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages.
- 8.8 High severity
StruxureWare Data Center Expert: Improper Neutralization of Special Elements used in an SQL Command
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unautho
- 8.8 High severity
StruxureWare Data Center Expert: Improper Neutralization of Special Elements used in an SQL Command
A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could allow a user already authenticated on DCE to access unauthorized content, change, or delete content, or perform unautho
- 8.1 High severity
StruxureWare Data Center Expert: Improper Neutralization of Special Elements used in an OS Command
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a user that knows the credentials to execute unprivileged shell commands on the appliance over SSH. Affected products: St
- 7.8 High severity
StruxureWare Data Center Expert: Improper Neutralization of Special Elements used in an OS Command
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Af
- 8.1 High severity
StruxureWare Data Center Expert: Missing Authorization
A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints. Affected products: S
- 9.8 Critical severity
StruxureWare Data Center Expert: Improper Control of Generation of Code
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostname” parameter when maliciously crafted hostname syntax is entered. Affected products: StruxureWare Data Center Expert (V7.
- 9.8 Critical severity
StruxureWare Data Center Expert: Improper Control of Generation of Code
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a parameter of the DCE network settings endpoint. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
- 8.8 High severity
StruxureWare Data Center Expert: Incorrect Authorization
A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low privileged user account. Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)