Vulnerability in Schneider-Electric Clearscada
CVE-2021-22741
Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure Geo SCADA Expert 2020 (V83.7742.1 and prior), which could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account password hashes.
EPSS: 0.002 (6.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Schneider-electric Clearscada
- Schneider-electric Ecostruxure_geo_scada_expert_2019
- Schneider-electric Ecostruxure_geo_scada_expert_2020
- N/a Clearscada (All Versions), Ecostruxure Geo Scada Expert 2019 And 2020 (V83.7742.1 Prior) — versions ClearSCADA,EcoStruxure Geo SCADA Expert 2019 and EcoStruxure Geo SCADA Expert 2020(see security notification for affected versions)
Weakness classification (CWE)
References
- cybersecurity@se.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-22741?
- CVE-2021-22741 is a medium-severity vulnerability in Schneider-Electric Clearscada, classified under Use of Password Hash With Insufficient Computational Effort. CVSS score: 6.7/10. Published 2021-05-26.
- How severe is CVE-2021-22741?
- Medium severity. CVSS v3 base score is 6.7 out of 10.