PT-2021-15217 · Schneider Electric · Ecostruxure Process Expert+2

Published 2021-09-20 · Updated 2022-04-23 · CVE-2021-22797

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert versions V15.0 SP1 and prior EcoStruxure Process Expert versions 2020 and prior SCADAPack RemoteConnect for x70 versions All

Description A path traversal vulnerability exists that could cause malicious scripts to be deployed in unauthorized locations, potentially resulting in code execution on the engineering workstation when a malicious project file is loaded in the engineering software.

Recommendations For EcoStruxure Control Expert versions V15.0 SP1 and prior, consider disabling the loading of project files from untrusted sources until a patch is available. For EcoStruxure Process Expert versions 2020 and prior, restrict access to the engineering software to minimize the risk of exploitation. For SCADAPack RemoteConnect for x70 versions All, avoid using the software to load project files from untrusted sources until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-22797

ZDI-21-1102

Affected Products

Ecostruxure Control Expert

Ecostruxure Process Expert

Scadapack Remoteconnect For X70

References · 5

• https://se.com/ww/en/download/document/SEVD-2021-257-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22797 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1102 · Security Note
• https://t.me/cibsecurity/40736 · Telegram Post