CVE-2021-22740 File upload in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
An attacker can upload unauthorized files to homeLYnk and spaceLYnk devices, resulting in the exposure of sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22740?
CVE-2021-22740 is a medium-severity vulnerability in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior, published on 26 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be exposed when an unauthorized file is uploaded.
Weakness: CWE-200
Which versions are affected by CVE-2021-22740?
It affects 2 products.
Products include Schneider-Electric Homelynk Firmware, Schneider-Electric Spacelynk Firmware.
How do I fix CVE-2021-22740?
No fix has been published for CVE-2021-22740 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22740 being exploited?
There is no known exploitation of CVE-2021-22740 in the wild and no public exploit code.
Other vulnerabilities in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22737 Hardcoded credentials in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22738 Weak cryptography in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22732 Privilege escalation in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22733 Privilege escalation in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22736 Path traversal in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
Sources
Also known as GHSA-6wqw-44p4-565j.