CVE-2021-22778

lowPriorität · verfolgen · 28EPSS 0.002 · 12. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.22% (12th) EPSS

CVSS 3.6 · low

Is it mine?

20 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause protected derived function blocks to be read or modified by unauthorized users when accessing a project file.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

MitigationEcoStruxure Control Expertcisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationEcoStruxure Process Expertcisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationModicon M340 CPU (part numbers BMXP34*)cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationModicon M580 CPU (part numbers BMEP* and BMEH*)cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationSCADAPack RemoteConnect for x70cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.6

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 3.6–8.6

v2.03.6lowAV:L/AC:L/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 4.9

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.2

v3.08.6highCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · CISA US

v3.18.6highAV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-522USCWE-522USCWE-522US

betroffene Produkte (20)

Betroffene Produkte und Versionsbereiche.

EcoStruxure Control Expert: all versions prior to v15.0 SP1 Including all versions of Unity Pro (former name of EcoStruxure Control Expert)alle Versionencisa_csaf_otUS
EcoStruxure Control Expert: v15.0 SP1alle Versionencisa_csaf_otUS
EcoStruxure Process Expert: all versions Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert)alle Versionencisa_csaf_otUS
Modicon M340 CPU (part numbers BMXP34*): all versionsalle Versionencisa_csaf_otUS
Modicon M580 CPU (part numbers BMEP* and BMEH*): all versionsalle Versionencisa_csaf_otUS
SCADAPack RemoteConnect for x70: all versionsalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Control Expertalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Control Expert< 15.0 SP1cisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Process Expertalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Modicon M340 CPU (part numbers BMXP34*)alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Modicon M580 CPU (part numbers BMEP* and BMEH*)alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC SCADAPack RemoteConnect for x70alle Versionencisa_csaf_otUS
n/a EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions≤ EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versionsenisa_euvdEU
Schneider Electric EcoStruxur Process Expert≤ V2021fstec_bduRU
Schneider Electric EcoStruxure Control Expert≤ V15.0 SP1fstec_bduRU
Schneider Electric SCADAPack RemoteConnect≤ R2.7.3fstec_bduRU
schneider-electric ecostruxure control expert< 15.0nvdUScpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:*
schneider-electric ecostruxure control expert= 15.0nvdUScpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:*
schneider-electric ecostruxure process expertalle VersionennvdUScpe:2.3:a:schneider-electric:ecostruxure_process_expert:*:*:*:*:*:*:*:*
schneider-electric remoteconnectalle VersionennvdUScpe:2.3:a:schneider-electric:remoteconnect:*:*:*:*:*:*:*:*

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-21-194-02Schneider Electric Modicon Controllers and Software (Update A)2021-07-13icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow arbitrary code execution and loss of confidentiality and integrity of the project file.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

veröffentlicht 2021-07-14geändert 2026-06-17

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan