PT-2025-32890 · Schneider Electric · Ecostruxure Power Monitoring Expert

Name of the Vulnerable Software and Affected Versions: Schneider Electric EcoStruxure Power Monitoring Expert affected versions not specified Description: The software contains a deserialization of untrusted data flaw within the GetFilteredSinkProvider component, potentially leading to remote cod...

(0Day) Schneider Electric EcoStruxure Power Monitoring Expert GetFilteredSinkProvider Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Monitoring Expert. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the GetFilteredSinkProvider...

(0Day) Schneider Electric EcoStruxure Power Monitoring Expert GetPagesAsImages Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric EcoStruxure Power Monitoring Expert. Authentication is not required to exploit this vulnerability. The specific flaw exists within the GetPagesAsImages method. The issue...

(0Day) Schneider Electric EcoStruxure Power Monitoring Expert GetTgmlContent Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Schneider Electric EcoStruxure Power Monitoring Expert. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetTgmlContent method. The issue results...

PT-2025-34059

Name of the Vulnerable Software and Affected Versions: SMB affected versions not specified Description: A vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and th...

PT-2025-34060

Name of the Vulnerable Software and Affected Versions: BMS affected versions not specified Description: An uncontrolled resource consumption issue exists that may lead to a denial of service. An authenticated user sending a specially crafted request to a specific endpoint within the BMS network c...

Schneider Electric EcoStruxure IT Data Center Expert 操作系统命令注入漏洞

Schneider Electric EcoStruxure IT Data Center Expert is a scalable monitoring software from Schneider Electric France that collects, organizes, and distributes critical device information to provide a comprehensive view of devices. Schneider Electric EcoStruxure IT Data Center Expert suffers from...

Schneider Electric EcoStruxure IT Data Center Expert 代码注入漏洞

Schneider Electric EcoStruxure IT Data Center Expert is a scalable monitoring software from Schneider Electric France that collects, organizes, and distributes critical device information to provide a comprehensive view of devices. A code injection vulnerability exists in Schneider Electric...

Schneider Electric EcoStruxure IT Data Center Expert 代码问题漏洞

Schneider Electric EcoStruxure IT Data Center Expert is a scalable monitoring software from Schneider Electric France that collects, organizes, and distributes critical device information to provide a comprehensive view of devices. A code issue vulnerability exists in Schneider Electric EcoStruxu...

Schneider Electric EcoStruxure IT Data Center Expert 代码问题漏洞

Schneider Electric EcoStruxure IT Data Center Expert is a scalable monitoring software from Schneider Electric France that collects, organizes, and distributes critical device information to provide a comprehensive view of devices. A server-side request forgery vulnerability exists in Schneider...

Schneider Electric EcoStruxure IT Data Center Expert 安全特征问题漏洞

Schneider Electric EcoStruxure IT Data Center Expert is a scalable monitoring software from Schneider Electric France that collects, organizes, and distributes critical device information to provide a comprehensive view of devices. Schneider Electric EcoStruxure IT Data Center Expert suffers from...

📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 Root Password Discovery

Schneider Electric EcoStruxure IT Data Center Expert versions 8.3 and below use logic contained within a JAR file and the MAC address to compute a "random" password for the root account. With access to the JAR file and knowledge of the MAC address, it is possible to determine the root password...

📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 Server-Side Request Forgery

Schneider Electric EcoStruxure IT Data Center Expert versions 8.3 and below insecurely forward HTTP requests based on user-controlled values, enabling an unauthenticated user to coerce the web application into sending data to arbitrary locations, such as the SMTP service listening on localhost...

📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 Privilege Escalation

Schneider Electric EcoStruxure IT Data Center Expert versions 8.3 and below contain a Charon executable that can be used by a low-privileged attacker to obtain root privileges. The Charon executable and configuration appears to be a local method for adding and removing services that run within th...

📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 Remote Command Execution

Schneider Electric EcoStruxure IT Data Center Expert versions 8.3 and below have a configuration modification issue where sufficient input sanitization is not performed on the value provided for the hostname of the appliance. The hostname variable can include a command terminator and subsequent...

Schneider Electric EcoStruxure IT Data Center Expert Privilege Escalation

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-266: Incorrect Privilege Assignment CVE ID: CVE-2025-50124 2. Vulnerability Description The Data Center Expert...

Schneider Electric EcoStruxure IT Data Center Expert XML External Entities Injection

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-611: Improper Restriction of XML External Entity Reference CVE ID: CVE-2025-6438 2. Vulnerability Description The...

Schneider Electric EcoStruxure IT Data Center Expert Unauthenticated Server-Side Request Forgery

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-918: Server-Side Request Forgery SSRF CVE ID: CVE-2025-50125 2. Vulnerability Description The Data Center Expert...

Schneider Electric EcoStruxure IT Data Center Expert Unauthenticated Remote Code Execution

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-23: Relative Path Traversal, CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS...

Schneider Electric EcoStruxure IT Data Center Expert Remote Command Execution

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-1286: Improper Validation of Syntactic Correctness of Input, CWE-94: Improper Control of Generation of Code 'Code...