CVE-2021-22781

schneider-electric ecostruxure control expert, schneider-electric ecostruxure process expert, schneider-electric remoteconnect

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-22781

Katalog CVE

CVSS 5.5 · Medium EPSS 0,24%

Kerentanan Insufficiently Protected Credentials pada schneider-electric ecostruxure control expert, schneider-electric ecostruxure process expert +1 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause a leak of SMTP credential used for mailbox authentication when an attacker can access a project file.

Rincian

Terbit di NVD
14 Juli 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-522: Insufficiently Protected Credentials
EPSS (30 hari)
0,24% peluang dieksploitasi; lebih tinggi dari 13,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
schneider-electric ecostruxure control expert Semua versi sebelum 15.0
schneider-electric ecostruxure control expert Versi 15.0
schneider-electric ecostruxure process expert Semua versi
schneider-electric remoteconnect Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.