Lucene search

[email protected]NVD:CVE-2021-22731

HistoryMay 26, 2021 - 8:15 p.m.

CVE-2021-22731

2021-05-2620:15:08

CWE-640

[email protected]

web.nvd.nist.gov

vulnerability

password recovery

modicon managed switch

unauthorized access

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.006

Percentile

79.1%

JSON

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

Affected configurations

Nvd

Node

schneider-electricmcsesp083f23g0_firmwareRange<8.22

AND

schneider-electricmcsesp083f23g0Match-

Node

schneider-electricmcsesp083f23g0t_firmwareRange<8.22

AND

schneider-electricmcsesp083f23g0tMatch-

Node

schneider-electricmcsesm043f23f0_firmwareRange<8.22

AND

schneider-electricmcsesm043f23f0Match-

Node

schneider-electricmcsesm053f1cu0_firmwareRange<8.22

AND

schneider-electricmcsesm053f1cu0Match-

Node

schneider-electricmcsesm063f2cu0_firmwareRange<8.22

AND

schneider-electricmcsesm063f2cu0Match-

Node

schneider-electricmcsesm053f1cs0_firmwareRange<8.22

AND

schneider-electricmcsesm053f1cs0Match-

Node

schneider-electricmcsesm063f2cs0_firmwareRange<8.22

AND

schneider-electricmcsesm063f2cs0Match-

Node

schneider-electricmcsesm083f23f0_firmwareRange<8.22

AND

schneider-electricmcsesm083f23f0Match-

Node

schneider-electricmcsesm103f2cu0_firmwareRange<8.22

AND

schneider-electricmcsesm103f2cu0Match-

Node

schneider-electricmcsesm083f23f0h_firmwareRange<8.22

AND

schneider-electricmcsesm083f23f0hMatch-

Node

schneider-electricmcsesm103f2cu0h_firmwareRange<8.22

AND

schneider-electricmcsesm103f2cu0hMatch-

Node

schneider-electricmcsesm103f2cs0h_firmwareRange<8.22

AND

schneider-electricmcsesm103f2cs0hMatch-

Node

schneider-electricmcsesm123f2lg0_firmwareRange<8.22

AND

schneider-electricmcsesm123f2lg0Match-

Node

schneider-electricmcsesm093f1cu0_firmwareRange<8.22

AND

schneider-electricmcsesm093f1cu0Match-

Node

schneider-electricmcsesm093f1cs0_firmwareRange<8.22

AND

schneider-electricmcsesm093f1cs0Match-

Node

schneider-electricmcsesm103f2cs0_firmwareRange<8.22

AND

schneider-electricmcsesm103f2cs0Match-

VendorProductVersionCPE
schneider-electricmcsesp083f23g0_firmware*cpe:2.3:o:schneider-electric:mcsesp083f23g0_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesp083f23g0-cpe:2.3:h:schneider-electric:mcsesp083f23g0:-:*:*:*:*:*:*:*
schneider-electricmcsesp083f23g0t_firmware*cpe:2.3:o:schneider-electric:mcsesp083f23g0t_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesp083f23g0t-cpe:2.3:h:schneider-electric:mcsesp083f23g0t:-:*:*:*:*:*:*:*
schneider-electricmcsesm043f23f0_firmware*cpe:2.3:o:schneider-electric:mcsesm043f23f0_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesm043f23f0-cpe:2.3:h:schneider-electric:mcsesm043f23f0:-:*:*:*:*:*:*:*
schneider-electricmcsesm053f1cu0_firmware*cpe:2.3:o:schneider-electric:mcsesm053f1cu0_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesm053f1cu0-cpe:2.3:h:schneider-electric:mcsesm053f1cu0:-:*:*:*:*:*:*:*
schneider-electricmcsesm063f2cu0_firmware*cpe:2.3:o:schneider-electric:mcsesm063f2cu0_firmware:*:*:*:*:*:*:*:*
schneider-electricmcsesm063f2cu0-cpe:2.3:h:schneider-electric:mcsesm063f2cu0:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	mcsesp083f23g0_firmware	*	cpe:2.3:o:schneider-electric:mcsesp083f23g0_firmware::::::::
schneider-electric	mcsesp083f23g0	-	cpe:2.3:h:schneider-electric:mcsesp083f23g0:-:::::::*
schneider-electric	mcsesp083f23g0t_firmware	*	cpe:2.3:o:schneider-electric:mcsesp083f23g0t_firmware::::::::
schneider-electric	mcsesp083f23g0t	-	cpe:2.3:h:schneider-electric:mcsesp083f23g0t:-:::::::*
schneider-electric	mcsesm043f23f0_firmware	*	cpe:2.3:o:schneider-electric:mcsesm043f23f0_firmware::::::::
schneider-electric	mcsesm043f23f0	-	cpe:2.3:h:schneider-electric:mcsesm043f23f0:-:::::::*
schneider-electric	mcsesm053f1cu0_firmware	*	cpe:2.3:o:schneider-electric:mcsesm053f1cu0_firmware::::::::
schneider-electric	mcsesm053f1cu0	-	cpe:2.3:h:schneider-electric:mcsesm053f1cu0:-:::::::*
schneider-electric	mcsesm063f2cu0_firmware	*	cpe:2.3:o:schneider-electric:mcsesm063f2cu0_firmware::::::::
schneider-electric	mcsesm063f2cu0	-	cpe:2.3:h:schneider-electric:mcsesm063f2cu0:-:::::::*

Rows per page:

1-10 of 321

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.006

Percentile

79.1%

JSON

Related for NVD:CVE-2021-22731

cvelist1 cve1 prion1