CVE-2021-22704
mediumpriority · track · 36EPSS 0.013 · 70 %ileEUUSEPSS · scored 2026-10-27
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
- n/a Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0)≤ Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0)enisa_euvdEU
- schneider-electric ecostruxure machine expert< 2.0nvdUScpe:2.3:a:schneider-electric:ecostruxure_machine_expert:*:*:*:*:*:*:*:*
- schneider-electric ecostruxure machine expert= 2.0nvdUScpe:2.3:a:schneider-electric:ecostruxure_machine_expert:*:*:*:*:*:*:*:*
- schneider-electric vijeo designer< 1.2nvdUScpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:*:*:*:*
- schneider-electric vijeo designer< 6.2.11nvdUScpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan