PT-2021-6897 · Schneider Electric · Guicon

Published 2021-11-09 · Updated 2022-02-03 · CVE-2021-22809

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eurotherm by Schneider Electric GUIcon versions prior to 2.0 (Build 683.003)

Description The issue is related to errors in processing *.gd1 configuration files, which could allow an attacker to gain access to protected information or cause a denial of service. A CWE-125: Out-of-Bounds Read issue exists, potentially leading to unintended data disclosure when a malicious *.gd1 configuration file is loaded into the GUIcon tool.

Recommendations For versions prior to 2.0 (Build 683.003), consider disabling the loading of *.gd1 configuration files until a patch is available to prevent potential exploitation. Restrict access to the GUIcon tool to minimize the risk of unintended data disclosure. Avoid using malicious or unverified *.gd1 configuration files with the GUIcon tool.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-02454

CVE-2021-22809

Affected Products

Guicon

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-22809 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22809 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02454 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07 · Vendor Advisory
• https://t.me/cibsecurity/36508 · Telegram Post
• https://t.me/cvenotify/26194 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-313-02 · Note
• https://cybersecurity-help.cz/vdb/SB2021111820 · Note