CVE-2025-50124 Schneider Electric CVE debrief

Who should care

Administrators and security teams responsible for Schneider Electric EcoStruxure IT Data Center Expert, especially in industrial, data center, or OT environments. Treat this as important if your deployment still runs version 8.3 or earlier, or if privileged console access is available to operators or support staff.

Technical summary

The advisory describes an improper privilege management flaw (CWE-269) in EcoStruxure IT Data Center Expert. The affected scope in the supplied CSAF data is Schneider Electric EcoStruxure IT Data Center Expert version 8.3 and prior. The issue is tied to privileged console access and a setup-script exploitation path, and the published CVSS vector reflects high privilege requirements and local/physical access conditions (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). Schneider Electric states that version 9.0 includes fixes.

Defensive priority

Medium overall by CVSS, but high priority for any exposed or actively used affected deployment because successful exploitation could grant elevated privileges in a critical management system.

Recommended defensive actions

• Upgrade Schneider Electric EcoStruxure IT Data Center Expert to version 9.0 as provided by Schneider Electric.
• If you cannot upgrade immediately, apply the vendor's mitigation guidance in the EcoStruxure IT Data Center Expert Security Handbook.
• Restrict and review privileged console access on affected servers, limiting access to only essential administrators.
• Inventory installations to confirm whether any instance is running version 8.3 or earlier.
• Validate change-control and administrative scripts associated with setup or deployment workflows before use.
• Follow CISA industrial control system recommended practices for defense-in-depth while remediation is pending.

Evidence notes

This debrief is based only on the supplied CSAF advisory metadata and referenced official links. The source item identifies CISA advisory ICSA-25-203-06, Schneider Electric as the vendor, EcoStruxure IT Data Center Expert as the product, affected versions as 8.3 and prior, and version 9.0 as the fixed release. The described weakness is CWE-269 improper privilege management, with the published timing set to 2025-07-08. The supplied enrichment also indicates this was not listed as a CISA KEV item.

Official resources