CVE-2021-22731

Published: May 26, 2021Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

Affected (16)

Products: Schneider Electric: Mcsesp083f23g0 Firmware, Mcsesp083f23g0t Firmware, Mcsesm043f23f0 Firmware, Mcsesm053f1cu0 Firmware, Mcsesm063f2cu0 Firmware, Mcsesm053f1cs0 Firmware, Mcsesm063f2cs0 Firmware, Mcsesm083f23f0 Firmware, Mcsesm103f2cu0 Firmware, Mcsesm083f23f0h Firmware, Mcsesm103f2cu0h Firmware, Mcsesm103f2cs0h Firmware, Mcsesm123f2lg0 Firmware, Mcsesm093f1cu0 Firmware, Mcsesm093f1cs0 Firmware, Mcsesm103f2cs0 Firmware

Schneider Electric

16 products

Mcsesp083f23g0 Firmware

Mcsesp083f23g0t Firmware

Mcsesm043f23f0 Firmware

Mcsesm053f1cu0 Firmware

Mcsesm063f2cu0 Firmware

Mcsesm053f1cs0 Firmware

Mcsesm063f2cs0 Firmware

Mcsesm083f23f0 Firmware

Mcsesm103f2cu0 Firmware

Mcsesm083f23f0h Firmware

Mcsesm103f2cu0h Firmware

Mcsesm103f2cs0h Firmware

Mcsesm123f2lg0 Firmware

Mcsesm093f1cu0 Firmware

Mcsesm093f1cs0 Firmware

Mcsesm103f2cs0 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesp083f23g0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesp083f23g0	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesp083f23g0t Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesp083f23g0t	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm043f23f0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm043f23f0	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm053f1cu0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm053f1cu0	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm063f2cu0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm063f2cu0	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm053f1cs0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm053f1cs0	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm063f2cs0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm063f2cs0	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm083f23f0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm083f23f0	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm103f2cu0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm103f2cu0	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm083f23f0h Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm083f23f0h	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm103f2cu0h Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm103f2cu0h	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm103f2cs0h Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm103f2cs0h	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm123f2lg0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm123f2lg0	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm093f1cu0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm093f1cu0	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm093f1cs0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm093f1cs0	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Mcsesm103f2cs0 Firmware	Before 8.22

Running on/with	Platform Versions
Schneider Electric Mcsesm103f2cs0	All versions

Related CWEs

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (2)

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01

Source: cybersecurity@se.com

PatchVendor Advisory

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-01

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.