CVE-2021-22697 File upload in EcoStruxure Power Build - Rapsody software V2.1.13 and prior.
Attackers can achieve remote code execution by uploading a malicious SSD file to EcoStruxure Power Build Rapsody, triggering a use-after-free condition.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-22697?
CVE-2021-22697 is a high-severity vulnerability in EcoStruxure Power Build - Rapsody software V2.1.13 and prior., published on 25 Jan 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
Weakness: CWE-434
Which versions are affected by CVE-2021-22697?
It affects 1 product.
Products include Schneider-Electric Ecostruxure Power Build - Rapsody.
How do I fix CVE-2021-22697?
No fix has been published for CVE-2021-22697 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22697 being exploited?
There is no known exploitation of CVE-2021-22697 in the wild and no public exploit code.
Other vulnerabilities in EcoStruxure Power Build - Rapsody software V2.1.13 and prior.
Sources
Also known as GHSA-wrwf-2jpv-j2gv.