Sign-up

ID

VAR-202105-0419


CVE

CVE-2021-22741


TITLE

plural  Schneider Electric  Vulnerability in the use of inadequately strong password hashes in products

Trust: 0.8

sources: JVNDB: JVNDB-2021-007428

DESCRIPTION

Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure Geo SCADA Expert 2020 (V83.7742.1 and prior), which could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account password hashes. Schneider Electric EcoStruxure Geo SCADA Expert (ClearSCADA) is a set of data acquisition and monitoring software (SCADA) of French Schneider Electric (Schneider Electric)

Trust: 1.71

sources: NVD: CVE-2021-22741 // JVNDB: JVNDB-2021-007428 // VULHUB: VHN-381215

AFFECTED PRODUCTS

vendor:schneider electricmodel:ecostruxure geo scada expert 2020scope:lteversion:83.7742.1

Trust: 1.0

vendor:schneider electricmodel:clearscadascope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:ecostruxure geo scada expert 2019scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:ecostruxure geo scada expert 2019scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:clearscadascope: - version: -

Trust: 0.8

vendor:schneider electricmodel:ecostruxure geo scada expert 2020scope:lteversion:83.7742.1 and earlier

Trust: 0.8

sources: JVNDB: JVNDB-2021-007428 // NVD: CVE-2021-22741

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-22741
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-22741
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202105-1735
value: MEDIUM

Trust: 0.6

VULHUB: VHN-381215
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-22741
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-381215
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-22741
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-22741
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-381215 // JVNDB: JVNDB-2021-007428 // CNNVD: CNNVD-202105-1735 // NVD: CVE-2021-22741

PROBLEMTYPE DATA

problemtype:CWE-916

Trust: 1.1

problemtype:Using weak password hashes (CWE-916) [ Other ]

Trust: 0.8

sources: VULHUB: VHN-381215 // JVNDB: JVNDB-2021-007428 // NVD: CVE-2021-22741

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202105-1735

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202105-1735

PATCH

title:SEVD-2021-130-07url:https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-07

Trust: 0.8

title:Schneider Electric EcoStruxure Geo SCADA Expert Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=152844

Trust: 0.6

sources: JVNDB: JVNDB-2021-007428 // CNNVD: CNNVD-202105-1735

EXTERNAL IDS

db:NVDid:CVE-2021-22741

Trust: 3.3

db:SCHNEIDERid:SEVD-2021-130-07

Trust: 1.7

db:JVNDBid:JVNDB-2021-007428

Trust: 0.8

db:CNNVDid:CNNVD-202105-1735

Trust: 0.7

db:VULHUBid:VHN-381215

Trust: 0.1

sources: VULHUB: VHN-381215 // JVNDB: JVNDB-2021-007428 // CNNVD: CNNVD-202105-1735 // NVD: CVE-2021-22741

REFERENCES

url:https://download.schneider-electric.com/files?p_doc_ref=sevd-2021-130-07

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-22741¥

Trust: 0.8

sources: VULHUB: VHN-381215 // JVNDB: JVNDB-2021-007428 // CNNVD: CNNVD-202105-1735 // NVD: CVE-2021-22741

SOURCES

db:VULHUBid:VHN-381215
db:JVNDBid:JVNDB-2021-007428
db:CNNVDid:CNNVD-202105-1735
db:NVDid:CVE-2021-22741

LAST UPDATE DATE

2024-08-14T15:22:18.875000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-381215date:2021-06-07T00:00:00
db:JVNDBid:JVNDB-2021-007428date:2022-02-10T08:59:00
db:CNNVDid:CNNVD-202105-1735date:2021-06-08T00:00:00
db:NVDid:CVE-2021-22741date:2021-06-07T17:10:01.570

SOURCES RELEASE DATE

db:VULHUBid:VHN-381215date:2021-05-26T00:00:00
db:JVNDBid:JVNDB-2021-007428date:2022-02-10T00:00:00
db:CNNVDid:CNNVD-202105-1735date:2021-05-26T00:00:00
db:NVDid:CVE-2021-22741date:2021-05-26T20:15:09.253