CVE-2021-22779 — Authentication Bypass by Spoofing in Ecostruxure Control Expert

CWE-290 — Authentication Bypass by Spoofing3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
0.2%
top 58.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Schneider-electric Ecostruxure Control Expert
Timeline
PublishedJul 14
Latest updateMay 24

Description

Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*), that could cause unauthorized access in read…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-qx3c-87pm-wqpc: Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15↗2022-05-24
▶
CVEList
CVE-2021-22779: Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15↗2021-07-14
▶
CVE-2021-22779 — Authentication Bypass by Spoofing | cvebase