CVE-2021-22698 File upload in EcoStruxure Power Build - Rapsody software V2.1.13 and prior.
Attackers can achieve remote code execution by uploading a malicious SSD file to EcoStruxure Power Build - Rapsody software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-22698?
CVE-2021-22698 is a high-severity vulnerability in EcoStruxure Power Build - Rapsody software V2.1.13 and prior., published on 25 Jan 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
Weakness: CWE-434
Which versions are affected by CVE-2021-22698?
It affects 1 product.
Products include Schneider-Electric Ecostruxure Power Build - Rapsody.
How do I fix CVE-2021-22698?
No fix has been published for CVE-2021-22698 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22698 being exploited?
There is no known exploitation of CVE-2021-22698 in the wild and no public exploit code.
Other vulnerabilities in EcoStruxure Power Build - Rapsody software V2.1.13 and prior.
Sources
Also known as GHSA-2fr7-wcm8-348v.