Schneider Electric Ecostruxure™ IT Data Center Expert vulnerabilities
7 vulnerabilities
Known vulnerabilities in Schneider Electric Ecostruxure™ IT Data Center Expert, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-6438schneider electricecostruxure™ it data center expert
EPSS score0.45%
A
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could
cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access
when the server is accessed via the network using an application account.CVE-2025-50122schneider electricecostruxure™ it data center expertEPSS score0.23%
A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the
password generation algorithm is reverse engineered with access to installation or upgrade artifacts.CVE-2025-50121schneider electricecostruxure™ it data center expertEPSS score22.07%
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created
over the web interface HTTP when enabled. HTTP is disabled by default.CVE-2025-50124schneider electricecostruxure™ it data center expertEPSS score0.21%
A
CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the
server is accessed by a privileged account via a console and through exploitation of a setup script.CVE-2025-50125schneider electricecostruxure™ it data center expertEPSS score0.54%
A
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote
code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation
of host request header.CVE-2025-50123schneider electricecostruxure™ it data center expertEPSS score0.38%
A
CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote
command execution by a privileged account when the server is accessed via a console and through
exploitation of the hostname input.CVE-2026-8045schneider electricecostruxure™ it data center expert+1EPSS score0.39%
CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an attacker with a Data Center Expert user account submits crafted XML payloads to SOAP service endpoints.