CVE-2025-50121 Schneider Electric CVE debrief

Who should care

Schneider Electric EcoStruxure™ IT Data Center Expert administrators, OT/IT security teams responsible for appliance hardening, and defenders managing environments where the DCE web interface is enabled over HTTP.

Technical summary

The advisory describes a CWE-78 OS command injection issue affecting Schneider Electric EcoStruxure™ IT Data Center Expert version 8.3 and prior. The stated impact is unauthenticated remote code execution triggered through the web interface when HTTP is enabled and a malicious folder is created. The provided CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, consistent with a critical network-reachable issue with high confidentiality, integrity, and availability impact. Schneider Electric’s remediation notes identify version 9.0 as fixed, available upon request, and recommend hardening the instance using the Security Handbook if immediate remediation is not applied.

Defensive priority

High. This is a CVSS 10.0 critical issue with unauthenticated RCE potential, but exposure depends on HTTP being enabled. Systems with HTTP enabled should be prioritized immediately; systems with HTTP disabled remain less exposed based on the advisory, but should still be upgraded.

Recommended defensive actions

• Upgrade EcoStruxure™ IT Data Center Expert to version 9.0, which Schneider Electric says includes fixes for the vulnerability.
• If you cannot upgrade immediately, follow Schneider Electric’s EcoStruxure™ IT Data Center Expert Security Handbook to harden the instance.
• Verify whether HTTP is enabled on any deployed DCE instance and disable it if it is not required.
• Limit network exposure to the DCE web interface to only trusted administrative networks.
• Review affected deployments of version 8.3 and earlier and schedule remediation as a priority.
• Monitor Schneider Electric and CISA advisory updates for any additional guidance.

Evidence notes

All claims are taken from the supplied CISA CSAF advisory (ICSA-25-203-06) and the linked Schneider Electric security notice references. The advisory states the vulnerability is CWE-78 OS command injection, affects Schneider Electric EcoStruxure™ IT Data Center Expert version 8.3 and prior, can cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled, and that HTTP is disabled by default. The remediation section states version 9.0 includes fixes and is available upon request.

Official resources