Vulnerability · Published Mar 28, 2022 · Assigned by schneider

CVE-2021-22797

High 7.8

In plain English

A high-severity path traversal in EcoStruxure Control Expert from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 26.1% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)26.1%top 2.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the engineering software. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior, including former Unity Pro), EcoStruxure Process Expert (2020 and prior, including former HDCS), SCADAPack RemoteConnect for x70 (All versions)

Affected products (as reported)

Vendor	Product	Versions
Schneider Electric	EcoStruxure Control Expert	unspecified – before V15.0 SP1
Schneider Electric	EcoStruxure Process Expert	unspecified – before 2020
Schneider Electric	SCADAPack RemoteConnect for x70	All versions

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.se.com/ww/en/download/document/SEVD-2021-257-01/ x_refsource_MISC