Schneider Electric EcoStruxure IT Data Center Expert Server-Side Request Forgery Vulnerability Leading to Remote Code Execution

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Schneider Electric's EcoStruxure IT Data Center Expert (DCE) software, specifically in versions through 8.3. This vulnerability allows unauthenticated remote code execution when the server is accessed over the network with knowledge of hidden URLs and manipulation of the host request header.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the server.

Remediation

Users of EcoStruxure IT Data Center Expert versions 8.3 and prior should upgrade to version 9.0, which includes fixes for this vulnerability. This update is available upon request from Schneider Electric's Customer Care Center. Customers are advised to back up their systems and evaluate the impact of the upgrade in a test environment before applying it.