OTPulse

Schneider Electric Data Center Expert

Plan PatchCVSS 7.2ICS-CERT ICSA-24-289-02Oct 8, 2024
Schneider ElectricEnergy
Attack path
Attack VectorNetwork
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary

Schneider Electric Data Center Expert (versions 8.1.1.3 and earlier) contains vulnerabilities in cryptographic signature validation (CWE-347) and authentication/authorization enforcement (CWE-306). An attacker with high-privilege credentials could bypass security controls to access confidential device information, system configurations, and monitoring data. The vulnerability does not allow unauthenticated access but could lead to unauthorized information disclosure if an attacker obtains or already possesses administrative credentials.

What this means
What could happen
An attacker with administrator or high-privilege access to Data Center Expert could disclose sensitive information about your infrastructure, including device configurations and monitoring data that could expose system design and vulnerabilities.
Who's at risk
Energy sector organizations and data center operators using Schneider Electric Data Center Expert for infrastructure monitoring. This product is commonly deployed in utility control centers, data centers supporting critical operations, and facilities managing backup power systems (UPS, cooling, power distribution).
How it could be exploited
An attacker with existing high-privilege credentials in Data Center Expert could access cryptographic functions improperly validated (CWE-347) or bypass authentication/authorization checks (CWE-306) to extract private data or confidential device information from the monitoring database or logs.
Prerequisites
  • High-privilege administrator account credentials for Data Center Expert
  • Network access to the Data Center Expert web interface (port typically 443)
  • Ability to authenticate to the application
Requires high privilege to exploitInformation disclosure riskAffects monitoring infrastructure visibilityCredentials must be known or compromised
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (1)
ProductAffected VersionsFix Status
Data Center Expert≤ 8.1.1.38.2
Remediation & Mitigation
0/5
Do now
0/2
HARDENINGEnforce least-privilege access: limit Data Center Expert user accounts to only those who need them, and verify each account has permissions matching their actual role
WORKAROUNDDelete any existing 'logcapture' archives from the system via https://server_ip/capturelogs after authentication
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Data Center Expert to version 8.2 or later
HARDENINGVerify SHA1 checksums of any Data Center Expert upgrade bundles before installing them
Long-term hardening
0/1
HARDENINGRestrict network access to the Data Center Expert management interface to authorized users only; do not expose it to untrusted networks or the internet
View full CISA ICS-CERT advisory
API: /api/v1/advisories/8cf4779d-68ce-41fd-87a7-3bc4be7bd42f

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.