CVE-2021-22779 CRITICAL

Published: 2021-07-14 | Last Modified: 2026-05-29 | Status: Modified

Description

Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*), that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.

Additional Descriptions (1)

Se presenta una vulnerabilidad de Omisión de Autenticación por Spoofing en EcoStruxure Control Expert (todas las versiones anteriores a V15.0 SP1, incluyendo todas las versiones de Unity Pro), EcoStruxure Control Expert versión V15.0 SP1, EcoStruxure Process Expert (todas las versiones, incluyendo todas las versiones de EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (todas las versiones), Modicon M580 CPU (todas las versiones - números de parte BMEP* y BMEH*), Modicon M340 CPU (todas las versiones - números de parte BMXP34*), que podría causar un acceso no autorizado en modo de lectura y escritura al controlador mediante el spoofing de la comunicación Modbus entre el software de ingeniería y el controlador

CVSS Metrics

Base Score: 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.2

Base Score: 6.4 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:P/A:N

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 4.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-290

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	ecostruxure_control_expert	*	<built-in method update of dict object at 0x7634bc297100>	Application
schneider-electric	ecostruxure_control_expert	15.0	<built-in method update of dict object at 0x763487f4e680>	Application
schneider-electric	ecostruxure_control_expert	15.0	<built-in method update of dict object at 0x7634bc285000>	Application
schneider-electric	ecostruxure_process_expert	*	<built-in method update of dict object at 0x7633d021ab40>	Application
schneider-electric	remoteconnect	*	<built-in method update of dict object at 0x763487f4fac0>	Application
schneider-electric	modicon_m580_bmep581020_firmware	*	<built-in method update of dict object at 0x7633d021b840>	Operating System
schneider-electric	modicon_m580_bmep581020h_firmware	*	<built-in method update of dict object at 0x7634bc2878c0>	Operating System
schneider-electric	modicon_m580_bmep582020_firmware	*	<built-in method update of dict object at 0x763482766880>	Operating System
schneider-electric	modicon_m580_bmep582020h_firmware	*	<built-in method update of dict object at 0x7634bc4b6680>	Operating System
schneider-electric	modicon_m580_bmep582040_firmware	*	<built-in method update of dict object at 0x7634bc9a7400>	Operating System
schneider-electric	modicon_m580_bmep582040h_firmware	*	<built-in method update of dict object at 0x7634b414cf00>	Operating System
schneider-electric	modicon_m580_bmep582040s_firmware	*	<built-in method update of dict object at 0x7634b414f600>	Operating System
schneider-electric	modicon_m580_bmep583020_firmware	*	<built-in method update of dict object at 0x7634b414d9c0>	Operating System
schneider-electric	modicon_m580_bmep583040_firmware	*	<built-in method update of dict object at 0x7634b414d940>	Operating System
schneider-electric	modicon_m580_bmep584020_firmware	*	<built-in method update of dict object at 0x7634b414fc40>	Operating System
schneider-electric	modicon_m580_bmep584040_firmware	*	<built-in method update of dict object at 0x7634b414c240>	Operating System
schneider-electric	modicon_m580_bmep584040s_firmware	*	<built-in method update of dict object at 0x7634b414e980>	Operating System
schneider-electric	modicon_m580_bmep585040_firmware	*	<built-in method update of dict object at 0x7634b414c040>	Operating System
schneider-electric	modicon_m580_bmep585040c_firmware	*	<built-in method update of dict object at 0x7634b414de40>	Operating System
schneider-electric	modicon_m580_bmep586040_firmware	*	<built-in method update of dict object at 0x7634b414d800>	Operating System
schneider-electric	modicon_m580_bmep586040c_firmware	*	<built-in method update of dict object at 0x7634b414ffc0>	Operating System
schneider-electric	modicon_m580_bmeh582040_firmware	*	<built-in method update of dict object at 0x7634b414da00>	Operating System
schneider-electric	modicon_m580_bmeh582040c_firmware	*	<built-in method update of dict object at 0x7634b414d900>	Operating System
schneider-electric	modicon_m580_bmeh582040s_firmware	*	<built-in method update of dict object at 0x7634b414fec0>	Operating System
schneider-electric	modicon_m580_bmeh584040_firmware	*	<built-in method update of dict object at 0x7634b414d5c0>	Operating System
schneider-electric	modicon_m580_bmeh584040c_firmware	*	<built-in method update of dict object at 0x7634b414f7c0>	Operating System
schneider-electric	modicon_m580_bmeh584040s_firmware	*	<built-in method update of dict object at 0x7634b414f740>	Operating System
schneider-electric	modicon_m580_bmeh586040_firmware	*	<built-in method update of dict object at 0x7634b414ef40>	Operating System
schneider-electric	modicon_m580_bmeh586040c_firmware	*	<built-in method update of dict object at 0x7634b414d1c0>	Operating System
schneider-electric	modicon_m580_bmeh586040s_firmware	*	<built-in method update of dict object at 0x7634b414c900>	Operating System
schneider-electric	modicon_m340_bmxp341000_firmware	*	<built-in method update of dict object at 0x7634b414e680>	Operating System
schneider-electric	modicon_m340_bmxp342010_firmware	*	<built-in method update of dict object at 0x7634b414df80>	Operating System
schneider-electric	modicon_m340_bmxp342020_firmware	*	<built-in method update of dict object at 0x7634b414fd40>	Operating System
schneider-electric	modicon_m340_bmxp342030_firmware	*	<built-in method update of dict object at 0x7634b414e0c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_control_expert::::::::`
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0:-::::::`
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_control_expert:15.0:sp1::::::`
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_process_expert::::::::`
Yes	`cpe:2.3:a:schneider-electric:remoteconnect:::::::scadapack_x70:*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep581020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep581020h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582020h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep583020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep583040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep585040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep585040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep586040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep586040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp341000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342010_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342010:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030:-:::::::*`

References

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
Source: [email protected]

Vendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory