CVE-2021-22779

mediumpriority · track · 36EPSS 0.011 · 64 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.05% (64th) EPSS

CVSS 6.4 · medium

Is it mine?

53 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*), that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationEcoStruxure Control Expertcisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationEcoStruxure Process Expertcisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationModicon M340 CPU (part numbers BMXP34*)cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationModicon M580 CPU (part numbers BMEP* and BMEH*)cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
MitigationSCADAPack RemoteConnect for x70cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.8

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USexploitability 10 · impact 4.9

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondaryexploitability 3.9 · impact 2.5

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-290USCWE-290USCWE-290US

affected products (53)

Products and version ranges known to be affected.

EcoStruxure Control Expert: all versions prior to v15.0 SP1 Including all versions of Unity Pro (former name of EcoStruxure Control Expert)all versionscisa_csaf_otUS
EcoStruxure Control Expert: v15.0 SP1all versionscisa_csaf_otUS
EcoStruxure Process Expert: all versions Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert)all versionscisa_csaf_otUS
Modicon M340 CPU (part numbers BMXP34*): all versionsall versionscisa_csaf_otUS
Modicon M580 CPU (part numbers BMEP* and BMEH*): all versionsall versionscisa_csaf_otUS
SCADAPack RemoteConnect for x70: all versionsall versionscisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Control Expertall versionscisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Control Expert< 15.0 SP1cisa_csaf_otUS
Schneider Electric Software, LLC EcoStruxure Process Expertall versionscisa_csaf_otUS
Schneider Electric Software, LLC Modicon M340 CPU (part numbers BMXP34*)all versionscisa_csaf_otUS
Schneider Electric Software, LLC Modicon M580 CPU (part numbers BMEP* and BMEH*)all versionscisa_csaf_otUS
Schneider Electric Software, LLC SCADAPack RemoteConnect for x70all versionscisa_csaf_otUS
n/a EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*)≤ EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*)enisa_euvdEU
Schneider Electric EcoStruxur Process Expert≤ V2021fstec_bduRU
Schneider Electric EcoStruxure Control Expert≤ V15.1fstec_bduRU
Schneider Electric EcoStruxure Control Expert≤ V15.0 SP1fstec_bduRU
Schneider Electric EcoStruxure Hybrid Distributed Control Systemall versionsfstec_bduRU
Schneider Electric Modicon M340≤ 3.50fstec_bduRU
Schneider Electric Modicon M580all versionsfstec_bduRU
Schneider Electric SCADAPack RemoteConnectall versionsfstec_bduRU

showing 20 of 53

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-21-194-02Schneider Electric Modicon Controllers and Software (Update A)2021-07-13icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow arbitrary code execution and loss of confidentiality and integrity of the project file.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot NVD CVE.org MITRE

published 2021-07-14modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan