CVE-2025-50122

🗓️ 11 Jul 2025 09:17:19Reported by schneiderType

cve🔗 web.nvd.nist.gov👁 18 Views🌐 WEB

Insufficient Entropy vulnerability allows root password discovery through reverse engineering access

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-50122	10 Jul 202501:48	–	circl
CNNVD	Schneider Electric EcoStruxure IT Data Center Expert 安全特征问题漏洞	11 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-50122	11 Jul 202509:17	–	cvelist
EUVD	EUVD-2025-21127	3 Oct 202520:07	–	euvd
KoreLogic Security	Schneider Electric EcoStruxure IT Data Center Expert Root Password Discovery	9 Jul 202500:00	–	korelogic
NCSC	Vulnerabilities fixed in Schneider Electric EcoStruxture IT Datacenter Expert	9 Jul 202508:38	–	ncsc
NVD	CVE-2025-50122	11 Jul 202510:15	–	nvd
Packet Storm	📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 Root Password Discovery	10 Jul 202500:00	–	packetstorm
Positive Technologies	PT-2025-29221 · Openssh · Openssh	11 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-50122	13 Jul 202509:22	–	redhatcve

[
  {
    "defaultStatus": "unaffected",
    "product": "EcoStruxure™ IT Data Center Expert",
    "vendor": "Schneider Electric",
    "versions": [
      {
        "lessThanOrEqual": "Prior to",
        "status": "affected",
        "version": "8.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
download	www.download.schneider-electric.com/files
seclists	www.seclists.org/fulldisclosure/2025/Jul/7

Parameter	Position	Path	Description	CWE
isxcMacAddress	path	/isxg/v1/internal/server	Unauthenticated API endpoint exposes MAC address used as seed for root password generation, enabling password derivation.	CWE-331

15 Apr 2026 00:35Current

6.5Medium risk

Vulners AI Score6.5

CVSS 48.9

EPSS0.00104

SSVC

CWE-331