StruxureWare Data Center Expert
Plan Patch8.8SEVD-2023-045-02Feb 14, 2023
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Multiple vulnerabilities in StruxureWare Data Center Expert versions 7.9.2 and earlier allow remote access and local privilege escalation via authorization bypass (CWE-863, CWE-862), command injection (CWE-78), code injection (CWE-94), and script injection (CWE-79). An authenticated attacker could gain full control of the appliance and disrupt critical infrastructure monitoring and control capabilities.
What this means
What could happen
An attacker with valid engineering credentials could gain full control of the data center monitoring platform, altering equipment setpoints, disabling alerts, or shutting down monitoring—disrupting visibility into critical infrastructure status.
Who's at risk
Energy sector operators (utilities, data centers, industrial facilities) who rely on StruxureWare Data Center Expert for monitoring power distribution, cooling, and critical infrastructure must update immediately. This affects all sites running versions 7.9.2 or earlier.
How it could be exploited
An attacker on the network with a valid engineering workstation account could exploit authorization flaws (CWE-863/862) or command injection (CWE-78) via the web interface to execute arbitrary code, escalate privileges locally, or bypass controls. Script injection (CWE-79) could compromise the web UI to manipulate monitoring data.
Prerequisites
- Network access to the StruxureWare Data Center Expert web interface
- Valid engineering workstation credentials
- Product version 7.9.2 or earlier
remotely exploitablelow complexity attackauthentication required but with valid credentialsaffects monitoring/visibility systemshigh CVSS score (8.8)
Exploitability
Moderate exploit probability (EPSS 5.8%)
Affected products (1)
ProductAffected VersionsFix Status
StruxureWare Data Center Expert≤ 7.9.27.9.3
Remediation & Mitigation
0/5
Do now
0/3HARDENINGRestrict network access to the StruxureWare web interface to authorized engineering stations only using firewall rules or network segmentation
HARDENINGEnforce strong, unique passwords for all engineering workstation accounts
HARDENINGDisable remote access to the appliance if not required for operations
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpdate StruxureWare Data Center Expert to version 7.9.3 or later
HOTFIXRequest version 7.9.3 from Schneider Electric's Customer Care Center
CVEs (9)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/29e4cefe-a0f0-408c-8680-79408d72154c