CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user.

CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user.

Schneider Electric is aware of a vulnerability in its EcoStruxure IT Gateway product. EcoStruxure IT Gateway product is software that handles communication with your monitored devices, gathering and sending device data for smart alarm notification. Failure to apply the remediations provided below may risk local privilege escalation, which could result in access to the database and compromising data integrity. Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment.