Database/Control plane, storage & DevOps
Schneider Electric StruxureWare Data Center Expert (V7.9.2 and prior) - Device File Transfer settings: Missing
Impact
Missing authorisation on the Device File Transfer settings lets an attacker view, change or delete content and invoke functions they should not have. Device File Transfer is how DCE pushes firmware and config to managed power and cooling devices - so control of it is control of what firmware lands on your UPS and PDU fleet.
Who can reach it
Remote access to the DCE endpoints, without the authorisation the function should require.
What to do
Upgrade past V7.9.2. Independently, gate firmware distribution: a DCIM system that can silently push firmware to power devices is a single point of catastrophic failure, and it deserves change control rather than trust.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.