Executive Summary

CVE-2025-13957 is a vulnerability in Schneider Electric’s EcoStruxure IT Data Center Expert software (version 9.0 and prior) involving the use of hard-coded credentials (CWE-798).

This vulnerability can lead to information disclosure and remote code execution if the SOCKS Proxy feature is enabled and an attacker knows the administrator and PostgreSQL database credentials.

The SOCKS Proxy is disabled by default, reducing the risk unless it is explicitly enabled.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can result in serious impacts including unauthorized disclosure of sensitive information and the ability for an attacker to execute remote code on the affected system.

The vulnerability has a high severity rating with a CVSS v4.0 base score of 7.5, indicating it can be exploited remotely with low attack complexity but requires high privileges.

Successful exploitation affects confidentiality, integrity, and availability of the system, potentially leading to system compromise or disruption of services.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves the use of hard-coded credentials when the SOCKS Proxy feature is enabled in Schneider Electric’s EcoStruxure IT Data Center Expert software. Detection would focus on verifying if the SOCKS Proxy is enabled and if the system is running a vulnerable version (9.0 or prior).

Specific commands are not provided in the available resources. However, general detection steps would include checking the configuration of the EcoStruxure IT Data Center Expert instance to confirm whether SOCKS Proxy is enabled, and verifying the software version.

Network scanning or monitoring for unusual activity related to SOCKS Proxy usage or attempts to use hard-coded credentials could also be part of detection, but no explicit commands or tools are detailed.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to apply the patch by upgrading to EcoStruxure IT Data Center Expert version 9.1 or later, which remediates this vulnerability.

If immediate patching is not possible, ensure that the SOCKS Proxy feature remains disabled, as it is disabled by default and required for exploitation.

Additional mitigation includes hardening the DCE instance according to the EcoStruxure IT Data Center Expert Security Handbook.

• Isolate control and safety system networks behind firewalls.
• Restrict physical access and secure controllers.
• Avoid unauthorized network connections and scan removable media.
• Minimize network exposure and use secure remote access methods such as VPNs, ensuring VPNs are kept updated and secure.

Useful 0 Not Useful 0