Paper/Archive/CVE-2021-22803

CVE-2021-22803

schneider — A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 80.1.801 × 2016.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths, when an attacker, writes arbitrary files to folders in context of the DC module, by sending constructed messages on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)

Affected

ProductAffectedFixed inSource

Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdownload.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-03