CVE-2021-22779 CRITICAL

Published: 2021-07-14 | Last Modified: 2026-05-29 | Status: Modified

Description

Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*), that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.

Additional Descriptions (1)

Se presenta una vulnerabilidad de Omisión de Autenticación por Spoofing en EcoStruxure Control Expert (todas las versiones anteriores a V15.0 SP1, incluyendo todas las versiones de Unity Pro), EcoStruxure Control Expert versión V15.0 SP1, EcoStruxure Process Expert (todas las versiones, incluyendo todas las versiones de EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (todas las versiones), Modicon M580 CPU (todas las versiones - números de parte BMEP* y BMEH*), Modicon M340 CPU (todas las versiones - números de parte BMXP34*), que podría causar un acceso no autorizado en modo de lectura y escritura al controlador mediante el spoofing de la comunicación Modbus entre el software de ingeniería y el controlador

CVSS Metrics

Base Score: 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.2

Base Score: 6.4 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:P/A:N

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 4.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-290

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	ecostruxure_control_expert	*	<built-in method update of dict object at 0x7e60a88c2740>	Application
schneider-electric	ecostruxure_control_expert	15.0	<built-in method update of dict object at 0x7e6111dd2280>	Application
schneider-electric	ecostruxure_control_expert	15.0	<built-in method update of dict object at 0x7e6111dd3880>	Application
schneider-electric	ecostruxure_process_expert	*	<built-in method update of dict object at 0x7e60eb2d86c0>	Application
schneider-electric	remoteconnect	*	<built-in method update of dict object at 0x7e60bbcf04c0>	Application
schneider-electric	modicon_m580_bmep581020_firmware	*	<built-in method update of dict object at 0x7e60ba9bd840>	Operating System
schneider-electric	modicon_m580_bmep581020h_firmware	*	<built-in method update of dict object at 0x7e60a88c2d40>	Operating System
schneider-electric	modicon_m580_bmep582020_firmware	*	<built-in method update of dict object at 0x7e61081f5800>	Operating System
schneider-electric	modicon_m580_bmep582020h_firmware	*	<built-in method update of dict object at 0x7e611232c700>	Operating System
schneider-electric	modicon_m580_bmep582040_firmware	*	<built-in method update of dict object at 0x7e60a88c1080>	Operating System
schneider-electric	modicon_m580_bmep582040h_firmware	*	<built-in method update of dict object at 0x7e6111e1bd80>	Operating System
schneider-electric	modicon_m580_bmep582040s_firmware	*	<built-in method update of dict object at 0x7e6110ddee00>	Operating System
schneider-electric	modicon_m580_bmep583020_firmware	*	<built-in method update of dict object at 0x7e6111e1b500>	Operating System
schneider-electric	modicon_m580_bmep583040_firmware	*	<built-in method update of dict object at 0x7e6110ddc780>	Operating System
schneider-electric	modicon_m580_bmep584020_firmware	*	<built-in method update of dict object at 0x7e61081f6e80>	Operating System
schneider-electric	modicon_m580_bmep584040_firmware	*	<built-in method update of dict object at 0x7e60e884bf40>	Operating System
schneider-electric	modicon_m580_bmep584040s_firmware	*	<built-in method update of dict object at 0x7e60ba9bce80>	Operating System
schneider-electric	modicon_m580_bmep585040_firmware	*	<built-in method update of dict object at 0x7e60ba9bff80>	Operating System
schneider-electric	modicon_m580_bmep585040c_firmware	*	<built-in method update of dict object at 0x7e6111e19780>	Operating System
schneider-electric	modicon_m580_bmep586040_firmware	*	<built-in method update of dict object at 0x7e60a89758c0>	Operating System
schneider-electric	modicon_m580_bmep586040c_firmware	*	<built-in method update of dict object at 0x7e60a8974700>	Operating System
schneider-electric	modicon_m580_bmeh582040_firmware	*	<built-in method update of dict object at 0x7e60ba9bd900>	Operating System
schneider-electric	modicon_m580_bmeh582040c_firmware	*	<built-in method update of dict object at 0x7e6112ef1780>	Operating System
schneider-electric	modicon_m580_bmeh582040s_firmware	*	<built-in method update of dict object at 0x7e6111e1b400>	Operating System
schneider-electric	modicon_m580_bmeh584040_firmware	*	<built-in method update of dict object at 0x7e6107bcdf00>	Operating System
schneider-electric	modicon_m580_bmeh584040c_firmware	*	<built-in method update of dict object at 0x7e60e8877040>	Operating System
schneider-electric	modicon_m580_bmeh584040s_firmware	*	<built-in method update of dict object at 0x7e60b85ed800>	Operating System
schneider-electric	modicon_m580_bmeh586040_firmware	*	<built-in method update of dict object at 0x7e611224c6c0>	Operating System
schneider-electric	modicon_m580_bmeh586040c_firmware	*	<built-in method update of dict object at 0x7e60a87828c0>	Operating System
schneider-electric	modicon_m580_bmeh586040s_firmware	*	<built-in method update of dict object at 0x7e60ba9bc4c0>	Operating System
schneider-electric	modicon_m340_bmxp341000_firmware	*	<built-in method update of dict object at 0x7e61342c9840>	Operating System
schneider-electric	modicon_m340_bmxp342010_firmware	*	<built-in method update of dict object at 0x7e6110a56ec0>	Operating System
schneider-electric	modicon_m340_bmxp342020_firmware	*	<built-in method update of dict object at 0x7e6110a55b80>	Operating System
schneider-electric	modicon_m340_bmxp342030_firmware	*	<built-in method update of dict object at 0x7e6110a9e980>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_control_expert::::::::`
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0:-::::::`
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0:sp1::::::`
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_process_expert::::::::`
Yes	`cpe:2.3:a:schneider-electric:remoteconnect:::::::scadapack_x70:*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep581020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep581020h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582020h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep583020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep583040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep585040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep585040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep586040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep586040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp341000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342010_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342010:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030:-:::::::*`

References

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
Source: [email protected]

Vendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory