Schneider Electric EcoStruxure IT Data Center Expert Insufficient Entropy Vulnerability Allowing Root Password Discovery

A vulnerability exists in Schneider Electric's EcoStruxure IT Data Center Expert (DCE) software, specifically in versions through 8.3. This vulnerability, categorized as CWE-331 (Insufficient Entropy), could lead to the discovery of the root password. The issue arises when the password generation algorithm is reverse-engineered using access to installation or upgrade artifacts.

Impact

Exploitation of this vulnerability could result in unauthorized root password discovery, potentially leading to unauthorized access and control over the system.

Remediation

Users of EcoStruxure IT Data Center Expert should upgrade to version 9.0, which includes fixes for this vulnerability. This version is available upon request from Schneider Electric's Customer Care Center. Customers are advised to back up their systems and evaluate the impact of the upgrade in a Test and Development environment or on an offline infrastructure. If assistance is needed, contact Schneider Electric's Customer Care Center.