Vulnerability · Published Jan 25, 2021 · Assigned by schneider
CVE-2021-22697
High 7.8
In plain English
A high-severity unrestricted file upload in EcoStruxure Power Build - Rapsody software V2.1.13 and prior.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)3.6%top 10.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | EcoStruxure Power Build - Rapsody software V2.1.13 and prior. | EcoStruxure Power Build - Rapsody software V2.1.13 and prior. |
Weakness: CWE-434
References
- https://www.se.com/ww/en/download/document/SEVD-2021-012-02/ x_refsource_MISC
- https://www.zerodayinitiative.com/advisories/ZDI-21-186/ x_refsource_MISC
- https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01 x_refsource_MISC