Vulnerability · Published Mar 10, 2026 · Assigned by schneider
CVE-2025-13957
High 7.5
In plain English
A high-severity hard-coded credentials in EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert) from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert) | v9.0 and prior |
Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N