CVE-2021-22717

published 2021-04-13

CVE-2021-22717: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could…

Priority P2 69 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when processing config files.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	c-bus_toolkit	<= 1.15.7	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2021-22717 is exploitable remotely with low attack complexity (AV:N/AC:L/PR:L) via path traversal when processing config files in Schneider Electric C-Bus Toolkit v1.15.7 and prior — monitor for suspicious config file processing activity on C-Bus Toolkit installations ↗
• → No known public exploits specifically target these vulnerabilities as of the advisory date (April 15, 2021) ↗

• · Affected product scope is limited to C-Bus Toolkit v1.15.7 and prior; only this version range is vulnerable to CVE-2021-22717 ↗
• · The path traversal vulnerability is triggered specifically during config file processing, not general file operations — detection should focus on that attack surface ↗
• · CVSS v3 score of 8.8 with network attack vector and low privilege requirement means the attack can be launched remotely by a low-privileged authenticated user ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22