Schneider Electric EcoStruxure IT Data Center Expert Improper Restriction of XML External Entity Reference Vulnerability

A vulnerability allowing improper restriction of XML external entity references has been identified in Schneider Electric's EcoStruxure IT Data Center Expert, all versions through 8.3. This vulnerability could lead to manipulation of SOAP API calls and injection of XML external entities, resulting in unauthorized access to files when the server is accessed over the network using an application account.

Impact

Exploitation of this vulnerability could result in unauthorized file access.

Remediation

Users can upgrade to version 9.0 of EcoStruxure IT Data Center Expert, which includes fixes for this vulnerability. This version is available upon request from Schneider Electric's Customer Care Center. Customers should evaluate the impact of the upgrade in a test environment and contact the Customer Care Center for assistance if needed.