CVE-2024-0865 is a high severity (CVSS 7.8) use of hard-coded credentials in Schneider Electric EcoStruxure IT Gateway that could allow local privilege escalation by a non-administrative user. Follow Schneider Electric notice SEVD-2024-044-03 and install the fixed release it names.
What's affected
Schneider Electric EcoStruxure IT Gateway. The record has no version bounds. It says a use of hard-coded credentials, CWE-798, could cause local privilege escalation when logged in as a non-administrative user.
The vendor notice is SEVD-2024-044-03, published as a PDF. Fixed versions are named there, not in the record.
The record classifies the weakness as CWE-798 (use of hard-coded credentials). NVD scores it 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Read the installed gateway version from the product's about screen or its installed program entry, then compare it with the version table in notice SEVD-2024-044-03. Also list who has local logon to the host that runs the gateway.
What to do now
- Read SEVD-2024-044-03 and identify the fixed version for your install.
- Install the update following the vendor's steps.
- Limit local logon on the gateway host to administrators who need it.
- Rotate any credentials the notice tells you to change.
Why it matters
Hard-coded credentials mean a secret is built into the product, so everyone who has the software has the secret. A low privilege local user can find and use it to gain more rights.
The local requirement keeps the score in the high range, but the gateway sits among infrastructure devices, so gaining admin on it can give a view of much more.
Two habits help with issues of this kind. First, keep a current inventory that records which machines run the product and which version, so a new advisory becomes a quick query instead of a hunt. Second, write down the owner of each system. Many fixes slip because nobody was sure who could approve the downtime. The free in-browser dependency scan at the scan page covers the application dependencies in your repositories, and the Gold directory lists known vulnerabilities by CVE, so you can see related entries for the same product.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Can I change the credential myself?
Not safely unless the vendor says so. The fix is in the vendor release.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
