Insufficiently protected credentials in Schneider Electric products - CVE-2021-22780
Published: July 14, 2021
Vulnerability identifier: #VU54864
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-22780
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficiently protected credentials. A remote authenticated attacker can gain unauthorized access to a project file protected by a password when this file is shared with untrusted sources and view and modify a project file.
Affected software
EcoStruxure Process Expert
SCADAPack RemoteConnect for x70
SCADAPack 470
SCADAPack 474
SCADAPack 570
SCADAPack 574
SCADAPack 575 RTUs
EcoStruxure Control Expert
SCADAPack RemoteConnect for x70
SCADAPack 470
SCADAPack 474
SCADAPack 570
SCADAPack 574
SCADAPack 575 RTUs
EcoStruxure Control Expert
How to mitigate CVE-2021-22780
Install updates from vendor's website.
EcoStruxure Control Expert - update to 15.0 SP1