Sign-up

ID

VAR-202106-0547


CVE

CVE-2021-22769


TITLE

Schneider Electric  Made  Enerlin'X Com'X 510  Improper permission management vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-001891

DESCRIPTION

A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.1 and older that could expose files or directory content when access from an attacker is not restricted or incorrectly restricted. Schneider Electric Provided by the company Enerlin'X Com'X 510 Inappropriate permission management vulnerability (CWE-269 , CVE-2021-22769) ExistsWhen the authenticated user receives a specially crafted request for the device, the device configuration information without viewing authority is disclosed. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.16

sources: NVD: CVE-2021-22769 // JVNDB: JVNDB-2021-001891 // CNNVD: CNNVD-202104-975

AFFECTED PRODUCTS

vendor:schneider electricmodel:easergy t300scope:lteversion:2.7.1

Trust: 1.0

vendor:schneider electricmodel:enerlin'x com'x 510scope:eqversion: -

Trust: 0.8

vendor:schneider electricmodel:enerlin'x com'x 510scope:eqversion:v6.8.4 all earlier s

Trust: 0.8

sources: JVNDB: JVNDB-2021-001891 // NVD: CVE-2021-22769

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-22769
value: MEDIUM

Trust: 1.0

IPA: JVNDB-2021-001891
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202106-978
value: MEDIUM

Trust: 0.6

NVD: CVE-2021-22769
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

NVD: CVE-2021-22769
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.1

Trust: 1.0

IPA: JVNDB-2021-001891
baseSeverity: HIGH
baseScore: 8.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2021-001891 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-978 // NVD: CVE-2021-22769

PROBLEMTYPE DATA

problemtype:CWE-552

Trust: 1.0

problemtype:Improper authority management (CWE-269) [IPA Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-001891 // NVD: CVE-2021-22769

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202106-978

TYPE

other

Trust: 1.2

sources: CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-978

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2021-22769

PATCH
title:Schneider Electric Security Notification Enerlin'X Com ’ X 510url:https://download.schneider-electric.com/files?p_doc_ref=sevd-2021-159-06
Trust: 0.8
title:Schneider Electric EnerlinÕX ComÕX Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=155012
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2021-001891 // 
            
            
            
            CNNVD: CNNVD-202106-978

EXTERNAL IDS
db:NVDid:CVE-2021-22769
Trust: 2.4
db:ICS CERTid:ICSA-21-168-01
Trust: 1.4
db:SCHNEIDERid:SEVD-2021-194-02
Trust: 1.0
db:JVNid:JVNVU93458321
Trust: 0.8
db:JVNDBid:JVNDB-2021-001891
Trust: 0.8
db:CS-HELPid:SB2021041363
Trust: 0.6
db:CNNVDid:CNNVD-202104-975
Trust: 0.6
db:CS-HELPid:SB2021061804
Trust: 0.6
db:SCHNEIDERid:SEVD-2021-159-06
Trust: 0.6
db:AUSCERTid:ESB-2021.2172
Trust: 0.6
db:CNNVDid:CNNVD-202106-978
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2021-001891 // 
            
            
            
            CNNVD: CNNVD-202104-975 // 
            
            
            
            CNNVD: CNNVD-202106-978 // 
            
            
            
            NVD: CVE-2021-22769

REFERENCES
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-168-01
Trust: 1.4
url:http://download.schneider-electric.com/files?p_doc_ref=sevd-2021-194-02
Trust: 1.0
url:http://jvn.jp/cert/jvnvu93458321
Trust: 0.8
url:https://www.cybersecurity-help.cz/vdb/sb2021041363
Trust: 0.6
url:http://download.schneider-electric.com/files?p_doc_ref=sevd-2021-159-06
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2021061804
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.2172
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2021-22769
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2021-001891 // 
            
            
            
            CNNVD: CNNVD-202104-975 // 
            
            
            
            CNNVD: CNNVD-202106-978 // 
            
            
            
            NVD: CVE-2021-22769

CREDITS
Maxim Rupp reported this vulnerability to CISA.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202106-978

SOURCES
db:JVNDBid:JVNDB-2021-001891
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202106-978
db:NVDid:CVE-2021-22769

LAST UPDATE DATE
2022-05-06T07:05:23.297000+00:00

SOURCES UPDATE DATE
db:JVNDBid:JVNDB-2021-001891date:2021-06-21T08:25:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202106-978date:2021-07-26T00:00:00
db:NVDid:CVE-2021-22769date:2021-09-20T13:51:00

SOURCES RELEASE DATE
db:JVNDBid:JVNDB-2021-001891date:2021-06-21T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202106-978date:2021-06-11T00:00:00
db:NVDid:CVE-2021-22769date:2021-06-11T16:15:00