CVE-2021-22704 — Path Traversal in Ecostruxure Machine Expert

CWE-22 — Path Traversal3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
0.6%
top 30.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Schneider-electric Ecostruxure Machine ExpertSchneider-electric Vijeo Designer
Timeline
PublishedSep 2
Latest updateMay 24

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-gw58-6f33-3447: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all v↗2022-05-24
▶
CVEList
CVE-2021-22704: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all v↗2021-09-02
▶
CVE-2021-22704 — Path Traversal | cvebase