PT-2021-15181 · Schneider Electric · Modicon Managed Switch Mcsesm

Published 2021-05-26 · Updated 2022-02-01 · CVE-2021-22731

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Modicon Managed Switch MCSESM* and MCSESP* versions V8.21 and prior

Description A Weak Password Recovery Mechanism for Forgotten Password issue exists, allowing an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

Recommendations For Modicon Managed Switch MCSESM* and MCSESP* versions V8.21 and prior, consider disabling the password recovery mechanism until a patch is available. Restrict access to the HTTP / HTTPS interfaces to minimize the risk of exploitation. Avoid using basic user information in the password recovery process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2021-22731

Affected Products

Modicon Managed Switch Mcsesm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-22731 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22731 · Vendor Advisory
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01 · Vendor Advisory
• https://t.me/cvenotify/15110 · Telegram Post