PT-2021-7723 · Schneider Electric · Spacelynk+1

Published 2021-05-11 · Updated 2021-06-03 · CVE-2021-22740

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric spaceLYnk versions prior to V2.60 Schneider Electric homeLYnk (Wiser For KNX) versions prior to V2.60

Description The issue is related to a lack of protection for service data, which could allow a remote attacker to expose protected information. An unauthorized file upload could also cause information to be exposed.

Recommendations For Schneider Electric spaceLYnk versions prior to V2.60, update to a version that includes the necessary security patches to protect service data. For Schneider Electric homeLYnk (Wiser For KNX) versions prior to V2.60, update to a version that includes the necessary security patches to protect against information exposure when uploading files. As a temporary workaround, consider restricting access to the file upload functionality in both spaceLYnk and homeLYnk until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-01749

CVE-2021-22740

Affected Products

Homelynk

Spacelynk

References · 5

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22740 · Security Note
• https://bdu.fstec.ru/vul/2023-01749 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22740 · Vendor Advisory
• https://vuldb.com/ru/?id.175931 · Note