IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2024-282-01 — Data Center Expert

HIGH
CVSS 7.2
Date 2026-10-16T20:33:08+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 08-Oct-24 Document Reference Number – SEVD-2024-282-01 Page 1 of 4 ## Data Center Expert 8 October 2024 ## Overview Schneider Electric is aware of a vulnerability in its Data Center Expert product. The Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment. Failure to apply the fix provided below may risk information disclosure, which could result in access to private data. ## Affected Products and Versions Product Version Data Center Expert Versions 8.1.1.3 and prior ## Vulnerability Details CVE ID: CVE-2024-8531 CVSS v3.1 Base Score 7.2 | High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is manipulated to include arbitrary bash scripts that are executed as root. CVE ID: CVE-2024-8530 CVSS v3.1 Base Score 5.9 | Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” archive is accessed directly by HTTPS. Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment. Schneider Electric Security Notification 08-Oct-24 Document Reference Number – SEVD-2024-282-01 Page 2 of 4

// Vulnerabilities (2)

CVE ID CVSS Score Severity Description
CVE-2024-8530 7.2 critical
CVE-2024-8530. CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” archive is accessed directly by HTTPS.
CVE-2024-8531 7.2 critical
CVE-2024-8531. CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an upgrade bundle is manipulated to include arbitrary bash scripts that are executed as root.

// Remediations (4)

Patch: Version 8.2 of EcoStruxure™ IT Data Center Expert includes fixes for these vulnerabilities and is a
Version 8.2 of EcoStruxure™ IT Data Center Expert includes fixes for these vulnerabilities and is available upon request from Schneider Electric’s Customer Care Center.
Mitigation: Ensure that the principals of least privilege are being followed so that only those with need have
Ensure that the principals of least privilege are being followed so that only those with need have account access and that the level of their respective account authorization aligns with their role, including Privileged Accounts as described in the Data Center Expert Security Handbook. • Verify SHA1 checksums of upgrade bundles prior to executing upgrades as described in the Upgrades section of the Data Center Expert Security Handbook.. • Delete any existing “logcapture” archives present on the system and do not create any new “logcapture” archives. Existing archives can be deleted from the https://server_ip/capturelogs web page after authenticating.
Patch: Version 8.2 of EcoStruxure™ IT Data Center Expert includes fixes for these vulnerabilities and is a
Version 8.2 of EcoStruxure™ IT Data Center Expert includes fixes for these vulnerabilities and is available upon request from Schneider Electric’s Customer Care Center.
Mitigation: Ensure that the principals of least privilege are being followed so that only those with need have
Ensure that the principals of least privilege are being followed so that only those with need have account access and that the level of their respective account authorization aligns with their role, including Privileged Accounts as described in the Data Center Expert Security Handbook. • Verify SHA1 checksums of upgrade bundles prior to executing upgrades as described in the Upgrades section of the Data Center Expert Security Handbook.. • Delete any existing “logcapture” archives present on the system and do not create any new “logcapture” archives. Existing archives can be deleted from the https://server_ip/capturelogs web page after authenticating.

// References