CVE-2021-22797
high · 7.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the engineering software. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior, including former Unity Pro), EcoStruxure Process Expert (2020 and prior, including former HDCS), SCADAPack RemoteConnect for x70 (All versions)
7.8
CVSS
26.1%
EPSS (exploit prob.)
98th
EPSS percentile
2022-04-13
Published
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| schneider-electric | ecostruxure_control_expert | < 15.1 |
| schneider-electric | ecostruxure_process_expert | < 2021 |
| schneider-electric | remoteconnect | all versions |
| schneider-electric | scadapack_470 | all versions |
| schneider-electric | scadapack_474 | all versions |
| schneider-electric | scadapack_570 | all versions |
| schneider-electric | scadapack_574 | all versions |
| schneider-electric | scadapack_575 | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-22797