This vulnerability (CWE-312) in Schneider Electric Ecostruxure™ Machine Expert HVAC affects versions prior to 1.10.0 and involves the cleartext storage of sensitive information, specifically protected source code. An authorized attacker with limited privileges (local access) could access this sensitive data without needing user interaction. The CVSS 4.0 vector indicates low attack complexity and no privileges required beyond limited local privileges, with high impact on confidentiality. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

The vulnerability could lead to unauthorized disclosure of protected source code, resulting in loss of confidentiality. This could potentially expose intellectual property or sensitive implementation details to an attacker with local access and limited privileges. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to authorized users only and monitor for any suspicious activity related to source code access. Avoid storing sensitive information in cleartext where possible.