PT-2022-9277 · Schneider Electric · Schneider Electric Software Update

Published 2022-01-28 · Updated 2022-02-03 · CVE-2021-22799

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schneider Electric Software Update versions V2.3.0 through V2.5.1

Description A CWE-331: Insufficient Entropy issue exists, potentially allowing an unintended connection from an internal network to an external network if an attacker decrypts the SESU proxy password from the registry.

Recommendations For versions V2.3.0 through V2.5.1, update to a version that includes a fix for the insufficient entropy issue to prevent unintended connections. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2021-22799

Affected Products

Schneider Electric Software Update

References · 4

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-02 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22799 · Security Note
• https://t.me/cibsecurity/36477 · Telegram Post