Schneider Electric EcoStruxure IT Data Center Expert Code Injection Vulnerability Leading to Remote Command Execution

A code injection vulnerability allowing remote command execution has been identified in Schneider Electric's EcoStruxure IT Data Center Expert (DCE) software, specifically in versions through 8.3. This vulnerability arises from improper control of code generation, which can be exploited by a privileged account. The issue occurs when the server is accessed via a console, taking advantage of the hostname input.

Impact

Exploitation of this vulnerability could result in unauthorized remote command execution on the affected server, carried out by a privileged account.

Remediation

Users of EcoStruxure IT Data Center Expert versions 8.3 and prior should upgrade to version 9.0, which includes fixes for this vulnerability. This update is available upon request from Schneider Electric's Customer Care Center. Customers are advised to back up their systems and evaluate the impact of the upgrade in a test environment before applying it.