CVE-2025-50123 Schneider Electric CVE debrief

Who should care

Operators, administrators, and security teams responsible for Schneider Electric EcoStruxure™ IT Data Center Expert deployments, especially environments where privileged console access is possible.

Technical summary

The advisory describes an improper control of code generation problem in EcoStruxure™ IT Data Center Expert. The impact is remote command execution, but the documented prerequisites are significant: access via a console and a privileged account. The supplied CVSS vector is AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, reflecting high impact with limited reachability. Schneider Electric identifies version 9.0 as the fixed release and notes that earlier versions through 8.3 are affected.

Defensive priority

High for any deployment running version 8.3 or earlier, especially where administrative console access is available. The exploit prerequisites narrow exposure, but the possible impact is severe enough to warrant prompt remediation.

Recommended defensive actions

• Upgrade EcoStruxure™ IT Data Center Expert to version 9.0, which Schneider Electric states includes fixes for this issue.
• If immediate upgrading is not possible, apply the vendor-recommended hardening guidance in the EcoStruxure™ IT Data Center Expert Security Handbook.
• Restrict and monitor privileged console access to the server, limiting access to only authorized administrators.
• Validate the installed product version and confirm whether any systems are still running version 8.3 or earlier.
• Review related industrial control system security guidance from CISA and Schneider Electric to reduce overall administrative and platform risk.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-203-06 and the linked Schneider Electric security notice for SEVD-2025-189-01. The source corpus states the vulnerability type (CWE-94), the affected product and version range (EcoStruxure™ IT Data Center Expert 8.3 and prior), the impact (remote command execution by a privileged account), the access condition (server accessed via a console and hostname input exploitation), the fixed version (9.0), and the CVSS vector (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.