Schneider Electric Vulnerabilities and Affected Products
Vulnerabilities associated with EcoStruxure™ IT Data Center Expert.
Products
Clear product- StruxureWare Data Center Expert15 vulnerabilities
- EcoStruxure Control Expert12 vulnerabilities
- Modicon M340 CPU (part numbers BMXP34*)12 vulnerabilities
- IGSS Data Server (IGSSdataServer.exe)10 vulnerabilities
- PowerChute™ Serial Shutdown10 vulnerabilities
- EcoStruxure Process Expert9 vulnerabilities
- IGSS Dashboard (DashBoard.exe)9 vulnerabilities
- Custom Reports (RMS16.dll)8 vulnerabilities
- IGSS Data Server(IGSSdataServer.exe)8 vulnerabilities
- EcoStruxure™ IT Data Center Expert7 vulnerabilities
- Modicon Controllers M241/M2517 vulnerabilities
- Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)7 vulnerabilities
- Modicon Momentum Unity M1E Processor (171CBU*)7 vulnerabilities
- OPC UA Modicon Communication Module7 vulnerabilities
- Pro-face BLUE7 vulnerabilities
- X80 advanced RTU Communication Module7 vulnerabilities
- Data Center Expert6 vulnerabilities
- EcoStruxure Operator Terminal Expert6 vulnerabilities
- EcoStruxure™ Power Monitoring Expert (PME)6 vulnerabilities
- EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module6 vulnerabilities
- Modicon M580 CPU (part numbers BMEP* and BMEH*)6 vulnerabilities
- Sage 14106 vulnerabilities
- Sage 14306 vulnerabilities
- Sage 14506 vulnerabilities
- Sage 24006 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-8045HIGH | Generated title:EcoStruxure IT Data Center Expert XML External Entity Information DisclosureCWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an attacker with a Data Center Expert user account submits crafted XML payloads to SOAP service endpoints. CWE-611Jun 9, 2026 | CVSS7.1v4.0 | EPSS0.233% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-50124HIGH | A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script. CWE-269Jul 11, 2025 | CVSS7.2v4.0 | EPSS0.182% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-50125MEDIUM | A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of host request header. CWE-918Jul 11, 2025 | CVSS6.3v4.0 | EPSS0.463% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-50123HIGH | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input. CWE-94Jul 11, 2025 | CVSS7.2v4.0 | EPSS0.313% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-50122HIGH | A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts. CWE-331Jul 11, 2025 | CVSS8.9v4.0 | EPSS0.196% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-50121CRITICAL | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP is disabled by default. CWE-78Jul 11, 2025 | CVSS9.5v4.0 | EPSS16% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-6438MEDIUM | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account. CWE-611Jul 11, 2025 | CVSS5.9v4.0 | EPSS0.391% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |