Schneider Electric EcoStruxure IT RCE via OS command injection
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Six vulnerabilities in EcoStruxure IT Data Center Expert v8.3 and prior allow unauthenticated remote code execution via OS command injection; no active exploitation reported.
Schneider Electric released a security advisory covering six vulnerabilities in EcoStruxure IT Data Center Expert versions 8.3 and prior, affecting critical manufacturing infrastructure worldwide. The most severe is CVE-2025-50121, an OS command injection flaw that enables unauthenticated remote code execution when a malicious folder is created via the HTTP web interface (disabled by default); CVSS v3.1 score 10.0. Five additional flaws include insufficient entropy in root password generation (CVE-2025-50122), code injection via hostname input (CVE-2025-50123), SSRF with knowledge of hidden URLs (CVE-2025-50125), improper privilege management via setup scripts (CVE-2025-50124), and XML External Entity injection in SOAP API calls (CVE-2025-6438). Successful exploitation could disrupt operations and grant access to system data. Schneider Electric has released version 9.0 with fixes available upon request from Customer Care Center. CISA reports no known public exploitation of these vulnerabilities as of the advisory date.
Mentioned in this report
Detection guidance
Linux Web Server or Java Process Spawning Shell With Download or Reverse-Shell Commands
Detects a web server, servlet container or CGI parent process spawning sh/bash with download-and-execute or reverse-shell arguments, which is the expected post-exploitation pattern of OS command injection in a web-facing management appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Web Server or Java Process Spawning Shell With Download or Reverse-Shell
Commands
description: Detects a web server, servlet container or CGI parent process spawning
a shell with download-and-execute or reverse-shell arguments. This is the typical
result of unauthenticated OS command injection in a web-facing management application
such as a data-center monitoring appliance. Matches the parent/child relation and
command-line pattern, not specific payloads.
tags:
- attack.execution
- attack.t1059.004
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /httpd
- /apache2
- /java
- /tomcat
- /php-cgi
- /php-fpm
- /nginx
- /lighttpd
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cli:
CommandLine|contains:
- wget
- curl
- /dev/tcp/
- nc -e
- mkfifo
- base64 -d
- chmod +x
- python -c
- perl -e
condition: all of selection_*
falsepositives:
- Web-based administration tools that legitimately invoke curl or wget through a shell
for updates or health checks
- Java-based deployment or build tooling running shell scripts that download artifacts
level: high
id: 20fc1b36-a847-538a-8b9b-4dc431e31e5f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06
Command Injection Metacharacters With Shell Commands in Web Request Query
Detects web requests whose query string combines shell metacharacters (plain or URL-encoded) with command-execution keywords, indicating OS command injection attempts against public-facing web interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Injection Metacharacters With Shell Commands in Web Request Query
description: Detects web requests whose query string combines shell command separators
or substitution (plain or URL-encoded) with command-execution keywords such as wget,
curl or /bin/sh. Indicates OS command injection attempts against a public-facing
web interface, for example through a folder-name parameter. Generic pattern, not
tied to a specific endpoint.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: webserver
detection:
selection_meta:
cs-uri-query|contains:
- ;
- '|'
- '`'
- $(
- '%3b'
- '%7c'
- '%60'
- '%24%28'
- '%26%26'
selection_cmd:
cs-uri-query|contains:
- wget
- curl
- /bin/sh
- /bin/bash
- busybox
- chmod
- /dev/tcp/
condition: all of selection_*
falsepositives:
- Security scanners run by the organisation against its own web applications
- Applications that pass URLs or file paths containing curl or wget strings as query
parameters
level: medium
id: 48f95dd5-bea1-5e03-9961-fc046acecae6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs