PT-2021-7277 · Schneider Electric · Scadapack Remoteconnect For X70+3

Published 2021-07-13 · Updated 2021-07-26 · CVE-2021-22780

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions EcoStruxure Control Expert versions prior to V15.0 SP1 EcoStruxure Process Expert (all versions) SCADAPack RemoteConnect for x70 (all versions) Unity Pro (all versions)

Description The issue is related to insufficient protection of credentials, which could allow unauthorized access to a project file protected by a password when shared with untrusted sources. An attacker may bypass the password protection, enabling them to view and modify the project file. This could potentially lead to unauthorized device access.

Recommendations For EcoStruxure Control Expert versions prior to V15.0 SP1, update to V15.0 SP1 or later to resolve the issue. For EcoStruxure Process Expert, consider restricting access to project files and limiting sharing with untrusted sources until a fix is available. For SCADAPack RemoteConnect for x70, restrict access to project files and avoid sharing them with untrusted sources until a fix is provided. For Unity Pro, limit access to project files and refrain from sharing them with untrusted sources until a resolution is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2022-05011

CVE-2021-22780

Affected Products

Ecostruxure Control Expert

Ecostruxure Process Expert

Scadapack Remoteconnect For X70

Unity Pro

References · 6

• https://osv.dev/vulnerability/CVE-2021-22780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22780 · Security Note
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05011 · Security Note
• https://fortiguard.com/zeroday/FG-VD-20-126 · Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01 · Note