Schneider Electric Data Center Expert (versions prior to v7.9.0) - credential storage: DCE stores device passwords

Impact

DCE stores device passwords in a recoverable format. Every UPS, PDU and cooling controller credential the DCIM system polls with can be recovered by an attacker who reaches the appliance. This is the amplifier that turns any of the other DCE bugs from 'one appliance' into 'the facility'.

Who can reach it

Network access to the DCE instance; recoverable-format storage means no cracking effort is needed once a foothold exists.

What to do

Upgrade to v7.9.0 or later, then rotate every stored credential - the upgrade re-protects new secrets, it does not un-leak old ones. Budget the rotation properly: it means touching every managed device, and on a large site that is the expensive part, not the upgrade.

References