Schneider Electric EcoStruxure Machine Expert HVAC Cleartext Storage Vulnerability Allowing Source Code Disclosure

A vulnerability allowing cleartext storage of sensitive information has been identified in Schneider Electric's EcoStruxure Machine Expert HVAC software, prior to version 1.10.0. This vulnerability could lead to the unauthorized disclosure of protected source code, allowing an authorized attacker to access the source code for editing or compilation, thereby compromising confidentiality.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of protected source code, leading to a loss of confidentiality.

Remediation

Users of EcoStruxure Machine Expert HVAC should upgrade to version 1.10.0, which includes a fix for this vulnerability. Version 1.10.0 is available for download from the Schneider Electric website.