// Description
Schneider Electric Security Notification
11-May-21 Document Reference Number – SEVD-2021 -130-07 Page 1 of 3
## EcoStruxure Geo SCADA Expert
11 May 2021
## Overview
Schneider Electric is aware of a vulnerability in its EcoStruxure Geo SCADA Expert products (formerly known as ClearSCADA).
The EcoStruxure Geo SCADA Expert product is an open, flexible and scalable software system for telemetry and remote SCADA solutions.
Failure to apply the remediations provided below may risk the revealing of account credentials, which could result in unauthorized system access.
## Affected Products and Versions
• ClearSCADA, all versions
• EcoStruxure Geo SCADA Expert 2019, all versions
• EcoStruxure Geo SCADA Expert 2020, V83.7742.1 and prior
## Vulnerability Details
CVE ID: CVE-2021-22741
CVSS v3.1 Base Score 6.7 | Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
A CWE-916: Use of Password Hash with Insufficient Computational Effort vulnerability exists that could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account password hashes.
## Remediation
Geo SCADA Expert 2020 April 2021 (83.7787.1) includes a fix for this vulnerability. The security of stored passwords in the servers is significantly strengthened. It is available for download here:
https://tprojects.schneider-electric.com/telemetry/display/CS/Geo+SCADA+Expert+Downloads
Installation of new server software will require system restart or changeover of redundant servers. Consult the Release Notes and Resource Center for advice on the procedure.