CVE-2021-22741

CWE-9163 documents3 sources
Severity
6.7MEDIUM
EPSS
0.0%
top 92.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Schneider-electric Ecostruxure GEO Scada Expert 2020
Timeline
PublishedMay 26
Latest updateMay 24

Description

Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure Geo SCADA Expert 2020 (V83.7742.1 and prior), which could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account passwo…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages1 packages

Patches

Patch: download.schneider-electric.com ↗Patch: download.schneider-electric.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gqjp-r446-ff55: Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all↗2022-05-24
▶
CVEList
CVE-2021-22741: Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all↗2021-05-26
▶