Risk | High |
Patch available | NO |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2021-22801 |
CWE-ID | CWE-269 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
ConneXium Network Manager Other software / Other software solutions |
Vendor | Schneider Electric |
Security Bulletin
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU57376
Risk: High
CVSSv3.1: 8.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2021-22801
CWE-ID:
CWE-269 - Improper Privilege Management
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to improper privilege management. A remote attacker can execute arbitrary commands when the software is configured with specially crafted event actions.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsConneXium Network Manager: All versions
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-21-287-01
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-02
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.