Vulnerability in Schneider-electric Ecostruxure_control_expert
CVE-2021-22779
Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, in…
EPSS: 0.010 (58.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Schneider-electric Ecostruxure_control_expert — versions 15.0
- Schneider-electric Ecostruxure_process_expert
- Schneider-electric Modicon_m340_bmxp341000
- Schneider-electric Modicon_m340_bmxp341000_firmware
- Schneider-electric Modicon_m340_bmxp342010
- Schneider-electric Modicon_m340_bmxp342010_firmware
- Schneider-electric Modicon_m340_bmxp342020
- Schneider-electric Modicon_m340_bmxp342020_firmware
- Schneider-electric Modicon_m340_bmxp342030
- Schneider-electric Modicon_m340_bmxp342030_firmware
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cybersecurity@se.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-22779?
- CVE-2021-22779 is a critical-severity vulnerability in Schneider-electric Ecostruxure_control_expert, classified under Authentication Bypass by Spoofing. CVSS score: 9.1/10. Published 2021-07-14.
- How severe is CVE-2021-22779?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2021-22779 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.