Schneider Electric StruxureWare Data Center Expert (V7.9.2 and prior) - Device File Transfer settings: Missing

Impact

Missing authorisation on the Device File Transfer settings lets an attacker view, change or delete content and invoke functions they should not have. Device File Transfer is how DCE pushes firmware and config to managed power and cooling devices - so control of it is control of what firmware lands on your UPS and PDU fleet.

Who can reach it

Remote access to the DCE endpoints, without the authorisation the function should require.

What to do

Upgrade past V7.9.2. Independently, gate firmware distribution: a DCIM system that can silently push firmware to power devices is a single point of catastrophic failure, and it deserves change control rather than trust.

References

Related entries

• Brocade SANnav Management Portal web interface, before v2.3.0 and v2.2.2a: Remote unauthenticated users can bypass webCVE-2023-31424 · Brocade SANnav Management Portal web interface, before v2.3.0 and v2.2.2aHigh
• OpenPMIx (PMIx library used by Slurm and Open MPI for job launch): A race in PMIx library code that executes with UID 0CVE-2023-41915 · OpenPMIx (PMIx library used by Slurm and Open MPI for job launch)High
• Ceph RADOS Gateway (RGW): RGW accepts a JWT whose header declares alg "none" and never checks the signature, so anyoneCVE-2024-48916 · Ceph RADOS Gateway (RGW)High
• HPE Insight Remote Support (Java deserialization): Java deserialization letting an unauthenticated attacker executeCVE-2024-53673 · HPE Insight Remote Support (Java deserialization)High
• PostgreSQL (libpq): Improper quoting in PQescape*CVE-2025-1094 · PostgreSQL (libpq)High
• HPE Performance Cluster Manager (HPCM) GUI authentication bypass: Authentication bypass in the HPCM web GUICVE-2025-27086 · HPE Performance Cluster Manager (HPCM) GUI authentication bypassHigh