PT-2021-6900 · Schneider Electric · Guicon

Published 2021-11-09 · Updated 2022-02-03 · CVE-2021-22807

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eurotherm by Schneider Electric GUIcon version 2.0 (Build 683.003) and prior

Description A CWE-787: Out-of-bounds Write issue exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIcon tool. This issue is related to the processing of *.gd1 configuration files, which can allow an attacker to execute arbitrary code.

Recommendations For Eurotherm by Schneider Electric GUIcon version 2.0 (Build 683.003) and prior, consider avoiding the use of malicious *.gd1 configuration files until a patch is available. As a temporary workaround, restrict the loading of *.gd1 files into the GUIcon tool to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-02457

CVE-2021-22807

Affected Products

Guicon

References · 8

• https://bdu.fstec.ru/vul/2022-02457 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22807 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22807 · Vendor Advisory
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-21-313-02 · Note
• https://t.me/cvenotify/26192 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021111820 · Note
• https://t.me/cibsecurity/36506 · Telegram Post