ZDI 2026-03-16

ZDI-26-212: Schneider Electric EcoStruxure Data Center Expert Hard-coded Password Remote Code Execution Vulnerability

CVE-2025-13957

Machine-generated analysis · WAYSCloud LLM

The advisory notes a hard-coded password vulnerability in Schneider Electric EcoStruxure Data Center Expert that allows remote code execution with authenticated access.

Context

Schneider Electric EcoStruxure Data Center Expert is affected by a hard-coded password vulnerability. The vulnerability enables remote attackers to execute arbitrary code, but requires authentication to exploit. The ZDI assigned a CVSS score of 8.8, indicating high severity according to their rating. Worth noting is that the presence of hard-coded credentials may allow persistent access if not addressed.

Operator considerations

Check: Verify if Schneider Electric EcoStruxure Data Center Expert is deployed with default or hard-coded credentials.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Data Center Expert. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-13957.

Read the full advisory on ZDI →