Schneider Electric EcoStruxure IT Data Center Expert Improper XML External Entity Reference Vulnerability

A vulnerability allowing improper restriction of XML external entity references has been identified in Schneider Electric's EcoStruxure IT Data Center Expert, all versions through 9.1.1. This vulnerability could lead to unauthorized disclosure of server-side file contents. It arises when an attacker with a Data Center Expert user account sends crafted XML payloads to SOAP service endpoints.

Impact

Exploitation of this vulnerability could result in unauthorized access to server-side file contents, leading to potential information disclosure.

Remediation

Users can upgrade to version 9.1.2 of EcoStruxure IT Data Center Expert, which addresses this vulnerability. This version is available for download from the EcoStruxure IT Data Center Expert product page. It is recommended to evaluate the impact of this patch in a test environment before applying it to production systems.