Lucene search

SchneiderCVE-2021-22731

HistoryMay 26, 2021 - 8:15 p.m.

CVE-2021-22731

2021-05-2620:15:08

CWE-640

schneider

web.nvd.nist.gov

cve-2021-22731

vulnerability

modicon

managed switch

weak password

password recovery

http

https

unauthorized access

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.006

Percentile

79.1%

JSON

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

Affected configurations

Nvd

Node

schneider-electricmcsesp083f23g0_firmwareRange<8.22

AND

schneider-electricmcsesp083f23g0Match-

Node

schneider-electricmcsesp083f23g0t_firmwareRange<8.22

AND

schneider-electricmcsesp083f23g0tMatch-

Node

schneider-electricmcsesm043f23f0_firmwareRange<8.22

AND

schneider-electricmcsesm043f23f0Match-

Node

schneider-electricmcsesm053f1cu0_firmwareRange<8.22

AND

schneider-electricmcsesm053f1cu0Match-

Node

schneider-electricmcsesm063f2cu0_firmwareRange<8.22

AND

schneider-electricmcsesm063f2cu0Match-

Node

schneider-electricmcsesm053f1cs0_firmwareRange<8.22

AND

schneider-electricmcsesm053f1cs0Match-

Node

schneider-electricmcsesm063f2cs0_firmwareRange<8.22

AND

schneider-electricmcsesm063f2cs0Match-

Node

schneider-electricmcsesm083f23f0_firmwareRange<8.22

AND

schneider-electricmcsesm083f23f0Match-

Node

schneider-electricmcsesm103f2cu0_firmwareRange<8.22

AND

schneider-electricmcsesm103f2cu0Match-

Node

schneider-electricmcsesm083f23f0h_firmwareRange<8.22

AND

schneider-electricmcsesm083f23f0hMatch-

Node

schneider-electricmcsesm103f2cu0h_firmwareRange<8.22

AND

schneider-electricmcsesm103f2cu0hMatch-

Node

schneider-electricmcsesm103f2cs0h_firmwareRange<8.22

AND

schneider-electricmcsesm103f2cs0hMatch-

Node

schneider-electricmcsesm123f2lg0_firmwareRange<8.22

AND

schneider-electricmcsesm123f2lg0Match-

Node

schneider-electricmcsesm093f1cu0_firmwareRange<8.22

AND

schneider-electricmcsesm093f1cu0Match-

Node

schneider-electricmcsesm093f1cs0_firmwareRange<8.22

AND

schneider-electricmcsesm093f1cs0Match-

Node

schneider-electricmcsesm103f2cs0_firmwareRange<8.22

AND

schneider-electricmcsesm103f2cs0Match-

VendorProductVersionCPE
schneider-electricmcsesp083f23g0_firmware*cpe:2.3:o:schneider-electric:mcsesp083f23g0_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesp083f23g0-cpe:2.3:h:schneider-electric:mcsesp083f23g0:-:*:*:*:*:*:*:*
schneider-electricmcsesp083f23g0t_firmware*cpe:2.3:o:schneider-electric:mcsesp083f23g0t_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesp083f23g0t-cpe:2.3:h:schneider-electric:mcsesp083f23g0t:-:*:*:*:*:*:*:*
schneider-electricmcsesm043f23f0_firmware*cpe:2.3:o:schneider-electric:mcsesm043f23f0_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesm043f23f0-cpe:2.3:h:schneider-electric:mcsesm043f23f0:-:*:*:*:*:*:*:*
schneider-electricmcsesm053f1cu0_firmware*cpe:2.3:o:schneider-electric:mcsesm053f1cu0_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesm053f1cu0-cpe:2.3:h:schneider-electric:mcsesm053f1cu0:-:*:*:*:*:*:*:*
schneider-electricmcsesm063f2cu0_firmware*cpe:2.3:o:schneider-electric:mcsesm063f2cu0_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesm063f2cu0-cpe:2.3:h:schneider-electric:mcsesm063f2cu0:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	mcsesp083f23g0_firmware	*	cpe:2.3:o:schneider-electric:mcsesp083f23g0_firmware::::::::
schneider-electric	mcsesp083f23g0	-	cpe:2.3:h:schneider-electric:mcsesp083f23g0:-:::::::*
schneider-electric	mcsesp083f23g0t_firmware	*	cpe:2.3:o:schneider-electric:mcsesp083f23g0t_firmware::::::::
schneider-electric	mcsesp083f23g0t	-	cpe:2.3:h:schneider-electric:mcsesp083f23g0t:-:::::::*
schneider-electric	mcsesm043f23f0_firmware	*	cpe:2.3:o:schneider-electric:mcsesm043f23f0_firmware::::::::
schneider-electric	mcsesm043f23f0	-	cpe:2.3:h:schneider-electric:mcsesm043f23f0:-:::::::*
schneider-electric	mcsesm053f1cu0_firmware	*	cpe:2.3:o:schneider-electric:mcsesm053f1cu0_firmware::::::::
schneider-electric	mcsesm053f1cu0	-	cpe:2.3:h:schneider-electric:mcsesm053f1cu0:-:::::::*
schneider-electric	mcsesm063f2cu0_firmware	*	cpe:2.3:o:schneider-electric:mcsesm063f2cu0_firmware::::::::
schneider-electric	mcsesm063f2cu0	-	cpe:2.3:h:schneider-electric:mcsesm063f2cu0:-:::::::*

Rows per page:

1-10 of 321

CNA Affected

[
  {
    "product": "Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior ",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.006

Percentile

79.1%

JSON

Related for CVE-2021-22731