Path Traversal in Schneider-Electric Ecostruxure Machine Expert
CVE-2021-22704
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.013 (67.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
Affected products
- Schneider-electric Ecostruxure_machine_expert — versions 2.0
- Schneider-electric Harmony_gk
- Schneider-electric Harmony_gto
- Schneider-electric Harmony_gtu
- Schneider-electric Harmony_gtux
- Schneider-electric Harmony_gxu
- Schneider-electric Harmony_scu
- Schneider-electric Harmony_sto
- Schneider-electric Harmony_stu
- Schneider-electric Vijeo_designer
Weakness classification (CWE)
References
- cybersecurity@se.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-22704?
- CVE-2021-22704 is a critical-severity vulnerability in Schneider-Electric Ecostruxure Machine Expert, classified under Path Traversal. CVSS score: 9.1/10. Published 2021-09-02.
- How severe is CVE-2021-22704?
- Critical severity. CVSS v3 base score is 9.1 out of 10.