CERT-In Vulnerability Note
CIVN-2022-0326
Multiple Vulnerabilities in Schneider Electric Products
Original Issue Date:August 17, 2022
Severity Rating: HIGH
Software Affected
- EcoStruxure Control Expert: All versions (including former Unity Pro) prior to V15.1 HF001
- EcoStruxure Process Expert: All versions (including former HDCS) prior to V2021
- SCADAPack RemoteConnect for x70: All versions prior to R2.7.3
Overview
Multiple vulnerabilities have been reported in Schneider Electric Products which could allow a remote attacker to execute arbitrary code and elevated privileges on the target system.
Description
These vulnerabilities exist in Schneider Electric Products due to a Heap-based Buffer Overflow, Wrap or Wraparound, Classic Buffer Overflow and Out-of-bounds Write. A remote attacker could exploit these vulnerabilities by sending specially crafted packets to the device over the network.
Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code and elevated privileges on the target system.
Solution
Apply appropriate patches as mentioned in the Schneider Security Advisory
https://www.se.com/ww/en/download/document/SEVD-2021-222-02/
Vendor Information
Schneider
https://www.se.com/in/en/
References
Schneider
https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-222-02_AT%26T_Labs-XMILX_DEMILL_Eco_Struxure_Control_ExpertEco_Struxure_Process_
Expert_SCADA_Pack_RemoteConnect_x70_Security_Notification_V4.0.pdf&p_Doc_Ref=SEVD-2021-222-02
CVE Name
CVE-2021-21810
CVE-2021-21811
CVE-2021-21812
CVE-2021-21813
CVE-2021-21814
CVE-2021-21815
CVE-2021-21825
CVE-2021-21826
CVE-2021-21827
CVE-2021-21828
CVE-2021-21829
CVE-2021-21830
CVE-2022-26507
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|