A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a

Successful exploitation of CVE-2025-50124 could grant an attacker unauthorized access to sensitive data and system resources. By leveraging a privileged account and exploiting the setup script, an attacker could gain administrative control over the EcoStruxure™ IT Data Center Expert system. This could lead to data breaches, system disruption, and potentially compromise the entire data center infrastructure. The blast radius extends to any data or services managed by the affected system, making it a critical security concern.

Organizations utilizing EcoStruxure™ IT Data Center Expert in environments where privileged accounts have console access are at risk. This includes data centers, industrial control systems, and any deployment pattern relying on this software for IT infrastructure management. Legacy configurations and systems with inadequate access controls are particularly vulnerable.

1. 2025-07-11Disclosure

   disclosure

1. Reserviert2025-06-12
2. Veröffentlicht2025-07-11
3. Geändert2025-11-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-50124 is to upgrade EcoStruxure™ IT Data Center Expert to version 8.3 or later, which includes the necessary security patches. If an immediate upgrade is not feasible, consider restricting access to the console and carefully reviewing the setup script for any suspicious modifications. While a direct workaround is unavailable, implementing the principle of least privilege and regularly auditing user accounts can help limit the potential impact of a successful exploit. After upgrade, confirm by verifying the version number within the software interface.