vulnerability
Schneider Electric EcoStruxure IT Data Center Expert
Medium
Summary
This report details a vulnerability discovered in Schneider Electric’s EcoStruxure IT Data Center Expert software, specifically versions up to 9.1.1. The vulnerability, classified as CWE-611, is an Improper Restriction of XML External Entity Reference that could allow an attacker with a user account to disclose server-side file contents via crafted XML payloads. Schneider Electric has released version 9.1.2 to address this issue, and users are advised to update immediately to mitigate the risk of information disclosure.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data