The vulnerability is an Improper Restriction of XML External Entity Reference (CWE-611) that allows an attacker with a Data Center Expert user account to submit specially crafted XML payloads to SOAP service endpoints. These payloads can cause server-side files to be read and returned to the attacker, thereby leaking confidential data. The impact is a loss of confidentiality as sensitive server files may be disclosed without prior system compromise.

Schneider Electric EcoStruxure IT Data Center Expert is affected. No specific version information is provided.

The CVSS score of 7.1 classifies the issue as high risk. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring authenticated access to a SOAP endpoint; an attacker can exploit the flaw by injecting XML external entity references to read files on the server.