CVE-2021-22795
Schneider Electric Struxureware Data Center Expert Command Injection Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)
Una CWE-78: Se presenta una vulnerabilidad de Neutralización Inapropiada de Elementos Especiales Usados en un Comando del Sistema Operativo (" Inyección de Comandos del Sistema Operativo") que podría causar una ejecución de código remota cuando es llevado a cabo a través de la red. Producto afectado: StruxureWare Data Center Expert (versiones V7.8.1 y anteriores)
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric Struxureware Data Center Expert. Authentication is required to exploit this vulnerability.
The specific flaw exists within the testRepository method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-06 CVE Reserved
- 2021-09-15 CVE Published
- 2024-08-03 CVE Updated
- 2024-11-01 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.se.com/ww/en/download/document/SEVD-2021-257-03 | 2022-04-20 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Schneider-electric Search vendor "Schneider-electric" | Struxureware Data Center Expert Search vendor "Schneider-electric" for product "Struxureware Data Center Expert" | <= 7.8.1 Search vendor "Schneider-electric" for product "Struxureware Data Center Expert" and version " <= 7.8.1" | - |
Affected
|