# Schneider Electric EcoStruxure IT RCE via OS command injection

Published: 2025-07-22 · Severity: elevated · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/9170af9e-bd65-5129-95a3-53778a98ca9d/schneider-electric-ecostruxure-it-rce-via-os-command-injection

> Six vulnerabilities in EcoStruxure IT Data Center Expert v8.3 and prior allow unauthenticated remote code execution via OS command injection; no active exploitation reported.

Schneider Electric released a security advisory covering six vulnerabilities in EcoStruxure IT Data Center Expert versions 8.3 and prior, affecting critical manufacturing infrastructure worldwide. The most severe is CVE-2025-50121, an OS command injection flaw that enables unauthenticated remote code execution when a malicious folder is created via the HTTP web interface (disabled by default); CVSS v3.1 score 10.0. Five additional flaws include insufficient entropy in root password generation (CVE-2025-50122), code injection via hostname input (CVE-2025-50123), SSRF with knowledge of hidden URLs (CVE-2025-50125), improper privilege management via setup scripts (CVE-2025-50124), and XML External Entity injection in SOAP API calls (CVE-2025-6438). Successful exploitation could disrupt operations and grant access to system data. Schneider Electric has released version 9.0 with fixes available upon request from Customer Care Center. CISA reports no known public exploitation of these vulnerabilities as of the advisory date.

## Mentioned in this report

- Vulnerabilities: CVE-2025-50121, CVE-2025-50122, CVE-2025-50123, CVE-2025-50124, CVE-2025-50125, CVE-2025-6438

## Detection guidance (public sample)

### Linux Web Server or Java Process Spawning Shell With Download or Reverse-Shell Commands

ATT&CK: T1059.004

Detects a web server, servlet container or CGI parent process spawning sh/bash with download-and-execute or reverse-shell arguments, which is the expected post-exploitation pattern of OS command injection in a web-facing management appliance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Web Server or Java Process Spawning Shell With Download or Reverse-Shell
  Commands
description: Detects a web server, servlet container or CGI parent process spawning
  a shell with download-and-execute or reverse-shell arguments. This is the typical
  result of unauthenticated OS command injection in a web-facing management application
  such as a data-center monitoring appliance. Matches the parent/child relation and
  command-line pattern, not specific payloads.
tags:
- attack.execution
- attack.t1059.004
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /java
    - /tomcat
    - /php-cgi
    - /php-fpm
    - /nginx
    - /lighttpd
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cli:
    CommandLine|contains:
    - wget
    - curl
    - /dev/tcp/
    - nc -e
    - mkfifo
    - base64 -d
    - chmod +x
    - python -c
    - perl -e
  condition: all of selection_*
falsepositives:
- Web-based administration tools that legitimately invoke curl or wget through a shell
  for updates or health checks
- Java-based deployment or build tooling running shell scripts that download artifacts
level: high
id: 20fc1b36-a847-538a-8b9b-4dc431e31e5f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06
```

### Command Injection Metacharacters With Shell Commands in Web Request Query

ATT&CK: T1190

Detects web requests whose query string combines shell metacharacters (plain or URL-encoded) with command-execution keywords, indicating OS command injection attempts against public-facing web interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Injection Metacharacters With Shell Commands in Web Request Query
description: Detects web requests whose query string combines shell command separators
  or substitution (plain or URL-encoded) with command-execution keywords such as wget,
  curl or /bin/sh. Indicates OS command injection attempts against a public-facing
  web interface, for example through a folder-name parameter. Generic pattern, not
  tied to a specific endpoint.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: webserver
detection:
  selection_meta:
    cs-uri-query|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '%3b'
    - '%7c'
    - '%60'
    - '%24%28'
    - '%26%26'
  selection_cmd:
    cs-uri-query|contains:
    - wget
    - curl
    - /bin/sh
    - /bin/bash
    - busybox
    - chmod
    - /dev/tcp/
  condition: all of selection_*
falsepositives:
- Security scanners run by the organisation against its own web applications
- Applications that pass URLs or file paths containing curl or wget strings as query
  parameters
level: medium
id: 48f95dd5-bea1-5e03-9961-fc046acecae6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9170af9e-bd65-5129-95a3-53778a98ca9d/schneider-electric-ecostruxure-it-rce-via-os-command-injection.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup