ICSA-21-194-02

icsaUScisa_csaf_ot

Schneider Electric Modicon Controllers and Software (Update A)

Advisory ansehen veröffentlicht 2021-07-13

Successful exploitation of these vulnerabilities may allow arbitrary code execution and loss of confidentiality and integrity of the project file.

01

beschreibt (6)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2021-22782USmedium5.5OT erhöht—
Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process…
CVE-2021-22781USmedium5.5—
Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process…
CVE-2021-22780UShigh7.1—
Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process…
CVE-2021-22779UScritical9.1—
Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Exp…
CVE-2021-22778UShigh7.1—
Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process…
CVE-2020-12525UShigh7.8—
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (30)

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan