cbcvebase.
CVE-2021-22719
published 2021-04-13

CVE-2021-22719: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could…

PriorityP268high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
40.58%
98.5th percentile
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when a file is uploaded.

Affected

1 ranges
VendorProductVersion rangeFixed in
schneider-electricc-bus_toolkit<= 1.15.7—

Detection & IOCsextracted from sources · hover to see the quote

  • →CVE-2021-22719 is a Path Traversal (CWE-22) vulnerability triggered during file upload operations in Schneider Electric C-Bus Toolkit; monitor for directory traversal sequences (e.g., '../') in file upload requests to the C-Bus Toolkit service ↗
  • →The vulnerability is remotely exploitable with low attack complexity and requires only low privileges (CVSS AV:N/AC:L/PR:L); prioritize detection of anomalous file upload activity from low-privileged remote users against C-Bus Toolkit instances ↗
  • →All C-Bus Toolkit versions up to and including v1.15.7 are affected; flag any network-accessible instances of this version for immediate patching or network isolation ↗
  • ·No known public exploits specifically target this vulnerability at the time of advisory publication; detection efforts should focus on behavioral/anomaly-based indicators rather than known exploit signatures ↗
  • ·The advisory covers five related CVEs (CVE-2021-22716 through CVE-2021-22720) in the same product; ensure detections are scoped specifically to the file-upload path traversal vector for CVE-2021-22719 and not conflated with the other path traversal or privilege management variants ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.