CVE-2021-22731

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesp083f23g0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesp083f23g0:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesp083f23g0t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesp083f23g0t:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm043f23f0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm043f23f0:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm053f1cu0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm053f1cu0:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm063f2cu0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm063f2cu0:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm053f1cs0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm053f1cs0:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm063f2cs0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm063f2cs0:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm083f23f0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm083f23f0:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm103f2cu0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm103f2cu0:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm083f23f0h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm083f23f0h:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm103f2cu0h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm103f2cu0h:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm103f2cs0h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm103f2cs0h:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm123f2lg0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm123f2lg0:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm093f1cu0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm093f1cu0:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm093f1cs0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm093f1cs0:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:schneider-electric:mcsesm103f2cs0_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:mcsesm103f2cs0:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:50

Type Values Removed Values Added
References () https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01 - Patch, Vendor Advisory () https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01 - Patch, Vendor Advisory

Information

Published : 2021-05-26 20:15

Updated : 2024-11-21 05:50


NVD link : CVE-2021-22731

Mitre link : CVE-2021-22731

CVE.ORG link : CVE-2021-22731


JSON object : View

Products Affected

schneider-electric

  • mcsesm103f2cs0h_firmware
  • mcsesm063f2cu0
  • mcsesm103f2cs0
  • mcsesm103f2cu0h_firmware
  • mcsesm103f2cu0_firmware
  • mcsesm053f1cu0_firmware
  • mcsesp083f23g0
  • mcsesm083f23f0_firmware
  • mcsesm083f23f0
  • mcsesm083f23f0h
  • mcsesm103f2cs0h
  • mcsesm043f23f0_firmware
  • mcsesm063f2cs0_firmware
  • mcsesm093f1cs0_firmware
  • mcsesm093f1cu0_firmware
  • mcsesm053f1cu0
  • mcsesp083f23g0t_firmware
  • mcsesm123f2lg0
  • mcsesm053f1cs0
  • mcsesm053f1cs0_firmware
  • mcsesm063f2cs0
  • mcsesm103f2cs0_firmware
  • mcsesp083f23g0t
  • mcsesm103f2cu0
  • mcsesm083f23f0h_firmware
  • mcsesm043f23f0
  • mcsesm093f1cu0
  • mcsesm123f2lg0_firmware
  • mcsesm063f2cu0_firmware
  • mcsesm103f2cu0h
  • mcsesm093f1cs0
  • mcsesp083f23g0_firmware
CWE
CWE-640

Weak Password Recovery Mechanism for Forgotten Password