CVE-2021-22817 Privilege escalation in Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)
Incorrect default permissions allow local attackers to access the installation directory and escalate privileges in Schneider HMI software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22817?
CVE-2021-22817 is a high-severity vulnerability in Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1), published on 9 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)
Weakness: CWE-276
Which versions are affected by CVE-2021-22817?
It affects 37 products.
Products include Schneider-Electric Hmibmiea5dd1001 Firmware, Schneider-Electric Hmibmiea5dd100a Firmware, Schneider-Electric Hmibmiea5dd1101 Firmware, Schneider-Electric Hmibmiea5dd110l Firmware, Schneider-Electric Hmibmiea5dd1e01 Firmware, Schneider-Electric Hmibmo0a5dd1001 Firmware and 31 more.
How do I fix CVE-2021-22817?
No fix has been published for CVE-2021-22817 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22817 being exploited?
There is no known exploitation of CVE-2021-22817 in the wild and no public exploit code.
Sources
Also known as GHSA-qhqr-hrxf-m49q.