Lucene search

SchneiderCVE-2021-22704

HistorySep 02, 2021 - 5:15 p.m.

CVE-2021-22704

2021-09-0217:15:08

CWE-22

schneider

web.nvd.nist.gov

cve-2021-22704

cwe-22

harmony

hmi

vijeo designer

ecostruxure

ftp

denial of service

unauthorized access

security vulnerability

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.

Affected configurations

Nvd

Node

schneider-electricvijeo_designerRange<6.2.11

AND

schneider-electricharmony_gkMatch-

schneider-electricharmony_gtoMatch-

schneider-electricharmony_gtuMatch-

schneider-electricharmony_gtuxMatch-

schneider-electricharmony_stoMatch-

schneider-electricharmony_stuMatch-

Node

schneider-electricvijeo_designerRange<1.2basic

AND

schneider-electricharmony_gxuMatch-

Node

schneider-electricecostruxure_machine_expertRange<2.0

schneider-electricecostruxure_machine_expertMatch2.0

AND

schneider-electricharmony_scuMatch-

VendorProductVersionCPE
schneider-electricvijeo_designer*cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:*:*:*:*
schneider-electricharmony_gk-cpe:2.3:h:schneider-electric:harmony_gk:-:*:*:*:*:*:*:*
schneider-electricharmony_gto-cpe:2.3:h:schneider-electric:harmony_gto:-:*:*:*:*:*:*:*
schneider-electricharmony_gtu-cpe:2.3:h:schneider-electric:harmony_gtu:-:*:*:*:*:*:*:*
schneider-electricharmony_gtux-cpe:2.3:h:schneider-electric:harmony_gtux:-:*:*:*:*:*:*:*
schneider-electricharmony_sto-cpe:2.3:h:schneider-electric:harmony_sto:-:*:*:*:*:*:*:*
schneider-electricharmony_stu-cpe:2.3:h:schneider-electric:harmony_stu:-:*:*:*:*:*:*:*
schneider-electricvijeo_designer*cpe:2.3:a:schneider-electric:vijeo_designer:*:*:*:*:basic:*:*:*
schneider-electricharmony_gxu-cpe:2.3:h:schneider-electric:harmony_gxu:-:*:*:*:*:*:*:*
schneider-electricecostruxure_machine_expert*cpe:2.3:a:schneider-electric:ecostruxure_machine_expert:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	vijeo_designer	*	cpe:2.3:a:schneider-electric:vijeo_designer::::::::
schneider-electric	harmony_gk	-	cpe:2.3:h:schneider-electric:harmony_gk:-:::::::*
schneider-electric	harmony_gto	-	cpe:2.3:h:schneider-electric:harmony_gto:-:::::::*
schneider-electric	harmony_gtu	-	cpe:2.3:h:schneider-electric:harmony_gtu:-:::::::*
schneider-electric	harmony_gtux	-	cpe:2.3:h:schneider-electric:harmony_gtux:-:::::::*
schneider-electric	harmony_sto	-	cpe:2.3:h:schneider-electric:harmony_sto:-:::::::*
schneider-electric	harmony_stu	-	cpe:2.3:h:schneider-electric:harmony_stu:-:::::::*
schneider-electric	vijeo_designer	*	cpe:2.3:a:schneider-electric:vijeo_designer:::::basic:::*
schneider-electric	harmony_gxu	-	cpe:2.3:h:schneider-electric:harmony_gxu:-:::::::*
schneider-electric	ecostruxure_machine_expert	*	cpe:2.3:a:schneider-electric:ecostruxure_machine_expert::::::::

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "product": "Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0)"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

68.3%

JSON

Related for CVE-2021-22704