A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert (Versions prior to V7.9.0)

A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert (Versions prior to V7.9.0)

Schneider Electric is aware of multiple vulnerabilities in its Data Center Expert product. The Data Center Expert product provides an efficient way for organizations to monitor and manage their company-wide multi-vendor physical infrastructure, including power, cooling, security and environmental. Failure to apply the remediations provided below may risk unauthorized access to a DCE instance, which could result in downtime or outage.