CVE-2021-22782

Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause an information leak allowing disclosure of network and process information, credentials or intellectual property when an attacker can access a project file.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01	Vendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:schneider-electric:ecostruxure_control_expert::::::::
	cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0:-::::::
	cpe:2.3:a:schneider-electric:ecostruxure_process_expert::::::::
	cpe:2.3:a:schneider-electric:remoteconnect:::::::scadapack_x70:*

History

21 Nov 2024, 05:50

Type	Values Removed	Values Added
References	~~() http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01 - Vendor Advisory~~	() http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01 - Vendor Advisory

Information

Published : 2021-07-14 15:15

Updated : 2024-11-21 05:50

NVD link : CVE-2021-22782

Mitre link : CVE-2021-22782

CVE.ORG link : CVE-2021-22782

JSON object : View

Products Affected

schneider-electric

ecostruxure_process_expert
ecostruxure_control_expert
remoteconnect

CWE

CWE-311

Missing Encryption of Sensitive Data

{"id": "CVE-2021-22782", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2021-07-14T15:15:08.447", "references": [{"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-311"}]}], "descriptions": [{"lang": "en", "value": "Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause an information leak allowing disclosure of network and process information, credentials or intellectual property when an attacker can access a project file."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de falta de encriptaci\u00f3n de datos confidenciales en EcoStruxure Control Expert (todas las versiones anteriores a V15.0 SP1, incluyendo todas las versiones de Unity Pro), EcoStruxure Process Expert (todas las versiones, incluyendo todas las versiones de EcoStruxure Hybrid DCS), y SCADAPack RemoteConnect for x70, todas las versiones, que podr\u00eda causar una filtraci\u00f3n de informaci\u00f3n permitiendo la divulgaci\u00f3n de informaci\u00f3n de red y de proceso, credenciales o propiedad intelectual cuando un atacante puede acceder a un archivo de proyecto"}], "lastModified": "2024-11-21T05:50:39.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_control_expert:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43140BF9-455B-4E3C-BF5E-BB9BBF9802D2", "versionEndExcluding": "15.0"}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9BF2D84-901E-4D34-941F-FFAB85B0E9D3"}, {"criteria": "cpe:2.3:a:schneider-electric:ecostruxure_process_expert:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD97669F-93D5-42C4-BFC4-1993867F5911"}, {"criteria": "cpe:2.3:a:schneider-electric:remoteconnect:*:*:*:*:*:*:scadapack_x70:*", "vulnerable": true, "matchCriteriaId": "2D7E0B75-171E-4A73-B722-13473CE1B9D7"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}