CVE-2021-22779

mediumPriorität · verfolgen · 36EPSS 0.011 · 64. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.05% (64th) EPSS

CVSS 6.4 · medium

Is it mine?

53 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*), that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

MitigationEcoStruxure Control Expertcisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationEcoStruxure Process Expertcisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationModicon M340 CPU (part numbers BMXP34*)cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationModicon M580 CPU (part numbers BMEP* and BMEH*)cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationSCADAPack RemoteConnect for x70cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.4–9.8

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 4.9

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.2

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NsecondaryAusnutzbarkeit 3.9 · Auswirkung 2.5

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-290USCWE-290USCWE-290US

betroffene Produkte (53)

Betroffene Produkte und Versionsbereiche.

EcoStruxure Control Expert: all versions prior to v15.0 SP1 Including all versions of Unity Pro (former name of EcoStruxure Control Expert)alle Versionencisa_csaf_otUS
EcoStruxure Control Expert: v15.0 SP1alle Versionencisa_csaf_otUS
EcoStruxure Process Expert: all versions Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert)alle Versionencisa_csaf_otUS
Modicon M340 CPU (part numbers BMXP34*): all versionsalle Versionencisa_csaf_otUS
Modicon M580 CPU (part numbers BMEP* and BMEH*): all versionsalle Versionencisa_csaf_otUS
SCADAPack RemoteConnect for x70: all versionsalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Control Expertalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Control Expert< 15.0 SP1cisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Process Expertalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Modicon M340 CPU (part numbers BMXP34*)alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Modicon M580 CPU (part numbers BMEP* and BMEH*)alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC SCADAPack RemoteConnect for x70alle Versionencisa_csaf_otUS
n/a EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*)≤ EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*)enisa_euvdEU
Schneider Electric EcoStruxur Process Expert≤ V2021fstec_bduRU
Schneider Electric EcoStruxure Control Expert≤ V15.1fstec_bduRU
Schneider Electric EcoStruxure Control Expert≤ V15.0 SP1fstec_bduRU
Schneider Electric EcoStruxure Hybrid Distributed Control Systemalle Versionenfstec_bduRU
Schneider Electric Modicon M340≤ 3.50fstec_bduRU
Schneider Electric Modicon M580alle Versionenfstec_bduRU
Schneider Electric SCADAPack RemoteConnectalle Versionenfstec_bduRU

20 von 53 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-21-194-02Schneider Electric Modicon Controllers and Software (Update A)2021-07-13icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow arbitrary code execution and loss of confidentiality and integrity of the project file.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2021-07-14geändert 2026-06-17

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan