What is CVE-2021-22805?

CVE-2021-22805 is a critical-severity vulnerability in Schneider-Electric Interactive Graphical Scada System Data Collector, classified under Missing Authentication for Critical Function. CVSS score: 9.1/10. Published 2022-02-11.

How severe is CVE-2021-22805?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Auth bypass in Schneider-Electric Interactive Graphical Scada System Data Collector

CVE-2021-22805

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network messages. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)

Vulnerability class: Broken Authentication

EPSS: 0.009 (54.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Schneider-electric Interactive_graphical_scada_system_data_collector
N/a Interactive Graphical Scada System Data Collector (Dc.exe) (V15.0.0.21243 And Prior) — versions Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

cybersecurity@se.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-22805?: CVE-2021-22805 is a critical-severity vulnerability in Schneider-Electric Interactive Graphical Scada System Data Collector, classified under Missing Authentication for Critical Function. CVSS score: 9.1/10. Published 2022-02-11.
How severe is CVE-2021-22805?: Critical severity. CVSS v3 base score is 9.1 out of 10.