CVE-2021-22797: Path Traversal
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the engineering software. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior, including former Unity Pro), EcoStruxure Process Expert (2020 and prior, including former HDCS), SCADAPack RemoteConnect for x70 (All versions)
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-22797?
CVE-2021-22797 is a Path Traversal vulnerability that allows malicious scripts to be deployed in unauthorized locations, potentially resulting in code execution.
In which software is CVE-2021-22797 found?
CVE-2021-22797 is found in Schneider-electric Ecostruxure Control Expert, Schneider-electric Ecostruxure Process Expert, and Schneider-electric Remoteconnect.
What is the severity level of CVE-2021-22797?
CVE-2021-22797 has a severity level of 7.8 (Critical).
How can CVE-2021-22797 be exploited?
CVE-2021-22797 can be exploited by loading a malicious project file in the affected software.
Is CVE-2021-22797 patched?
There is no information available about CVE-2021-22797 being patched at the moment. It is recommended to follow the recommendations provided by the vendor.