High severity · published Jul 11, 2025
CVE-2025-50122
A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to…
8.9
CVSS
0.2%
EPSS
No
On KEV
Description
A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the
password generation algorithm is reverse engineered with access to installation or upgrade artifacts.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EI
EcoStruxure™ IT Data Center Expert · Schneider Electric
8.3 through Prior to · source: vendor
Affected product
EI
EcoStruxure™ IT Data Center Expert
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-50122
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-50122
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-189-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-189-01.pdf
seclists.org
http://seclists.org/fulldisclosure/2025/Jul/7
More from EcoStruxure™ IT Data Center Expert
9.5
CVE-2025-50121
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remote code execution…
7.2
CVE-2025-50124
A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and…
7.2
CVE-2025-50123
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account when the server is…
6.5
CVE-2026-8045
CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an attacker with a…
6.3
CVE-2025-50125
A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with…