CVE-2021-22779

Published: Jul 14, 2021Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*), that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.

Affected (34)

Schneider Electric

32 products

Ecostruxure Control Expert

Ecostruxure Process Expert

Remoteconnect

Modicon M580 Bmep581020 Firmware

Modicon M580 Bmep581020h Firmware

Modicon M580 Bmep582020 Firmware

Modicon M580 Bmep582020h Firmware

Modicon M580 Bmep582040 Firmware

Modicon M580 Bmep582040h Firmware

Modicon M580 Bmep582040s Firmware

Modicon M580 Bmep583020 Firmware

Modicon M580 Bmep583040 Firmware

Modicon M580 Bmep584020 Firmware

Modicon M580 Bmep584040 Firmware

Modicon M580 Bmep584040s Firmware

Modicon M580 Bmep585040 Firmware

Modicon M580 Bmep585040c Firmware

Modicon M580 Bmep586040 Firmware

Modicon M580 Bmep586040c Firmware

Modicon M580 Bmeh582040 Firmware

Modicon M580 Bmeh582040c Firmware

Modicon M580 Bmeh582040s Firmware

Modicon M580 Bmeh584040 Firmware

Modicon M580 Bmeh584040c Firmware

Modicon M580 Bmeh584040s Firmware

Modicon M580 Bmeh586040 Firmware

Modicon M580 Bmeh586040c Firmware

Modicon M580 Bmeh586040s Firmware

Modicon M340 Bmxp341000 Firmware

Modicon M340 Bmxp342010 Firmware

Modicon M340 Bmxp342020 Firmware

Modicon M340 Bmxp342030 Firmware

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Ecostruxure Control Expert	Before 15.0
Schneider Electric Ecostruxure Control Expert	Version 15.0
Schneider Electric Ecostruxure Control Expert	Version 15.0 sp1
Schneider Electric Ecostruxure Process Expert	All versions
Schneider Electric Remoteconnect	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep581020 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep581020	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep581020h Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep581020h	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep582020 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep582020	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep582020h Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep582020h	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep582040 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep582040	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep582040h Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep582040h	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep582040s Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep582040s	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep583020 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep583020	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep583040 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep583040	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep584020 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep584020	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep584040 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep584040	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep584040s Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep584040s	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep585040 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep585040	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep585040c Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep585040c	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep586040 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep586040	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep586040c Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep586040c	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh582040 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh582040	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh582040c Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh582040c	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh582040s Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh582040s	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh584040 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh584040	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh584040c Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh584040c	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh584040s Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh584040s	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh586040 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh586040	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh586040c Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh586040c	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh586040s Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh586040s	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp341000 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp341000	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342010 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342010	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342020 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342020	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342030 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342030	All versions

Related CWEs

CWE-290

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (2)

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01

Source: cybersecurity@se.com

Vendor Advisory

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.