Manipulation of Upgrade Bundles Could Compromise Root Access

CVE-2024-8531

Summary

A vulnerability exists within Schneider Electric's Data Center Expert software that pertains to improper verification of cryptographic signatures. This issue arises when upgrade bundles are manipulated to contain arbitrary bash scripts, which can then be executed with root privileges. Such a flaw raises significant security concerns, as it potentially allows unauthorized code execution, leading to system compromise and data integrity issues. Organizations utilizing this software should assess their security posture and implement necessary measures to mitigate risks associated with this vulnerability.

References