Schneider Electric Building Operation Automation Server version 1.6.1.5000 suffers from OS command injection, weak credential management, and privilege escalation vulnerabilities.