CVE-2021-22772 Missing authorization in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104) SC2-04IEC-07000100 and earlier), and Easergy T200 ((DNP3) SC2-04DNP-07000102 and earlier)
Attackers can bypass authentication to perform unauthorized operations on Schneider Electric Easergy T200 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22772?
CVE-2021-22772 is a critical missing authorization vulnerability in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104) SC2-04IEC-07000100 and earlier), and Easergy T200 ((DNP3) SC2-04DNP-07000102 and earlier), published on 21 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104) SC2-04IEC-07000100 and earlier), and Easergy T200 ((DNP3) SC2-04DNP-07000102 and earlier) that could cause unauthorized operation when authentication is bypassed.
Weakness: CWE-306
Which versions are affected by CVE-2021-22772?
It affects 3 products.
Products include Schneider-Electric T200e Firmware, Schneider-Electric T200i Firmware, Schneider-Electric T200p Firmware.
How do I fix CVE-2021-22772?
No fix has been published for CVE-2021-22772 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-22772 being exploited?
There is no known exploitation of CVE-2021-22772 in the wild and no public exploit code.
Sources
Also known as GHSA-9gg2-wj6f-29qm.