Authentication Bypass by Spoofing in Schneider Electric products - CVE-2021-22779

Vulnerability identifier: #VU54863

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22779

CWE-ID: CWE-290

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the authentication bypass by spoofing issue. A remote attacker can gain unauthorized access in read and write mode to the controller.

EcoStruxure Process Expert
SCADAPack RemoteConnect for x70
SCADAPack 470
SCADAPack 474
SCADAPack 570
SCADAPack 574
SCADAPack 575 RTUs
EcoStruxure Control Expert
Modicon M580
Modicon M340

Install update from vendor's website.

EcoStruxure Process Expert - update to V2021
Modicon M340 - update to 3.50
EcoStruxure Control Expert - update to 15.1

• https://ics-cert.us-cert.gov/advisories/icsa-21-194-02
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
• https://ics-cert.kaspersky.com/advisories/2022/05/20/klcert-20-061-klcert-20-068-schneider-electric-modicon-m340-m580-authentication-bypass-by-spoofing/

• Multiple vulnerabilities in Schneider Electric SCADApack RTU, Modicon Controllers and Software