High ICSA-21-105-01 5 CVEs

Schneider Electric C-Bus Toolkit

Published Apr 15, 2021 · Updated Apr 15, 2021 · Revision 2

Vendor: Schneider Electric Product: C-Bus Toolkit

Summary

Successful exploitation of these vulnerabilities may allow remote code execution.

Vulnerabilities 5

High 7.8

CVE-2021-22716

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code exec…

Schneider Electric C-Bus Toolkit ICS / OT

Apr 13, 2021
Unscored —

CVE-2021-22717 EPSS 40%

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus …

Apr 13, 2021
Unscored —

CVE-2021-22718 EPSS 28%

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus …

Apr 13, 2021
Unscored —

CVE-2021-22719 EPSS 42%

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus …

Apr 13, 2021
Unscored —

CVE-2021-22720 EPSS 31%

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus …

Apr 13, 2021

Revision history

2021-04-15 #1
ICSA-21-105-01 Schneider Electric C-Bus Toolkit
2021-04-15 #2
ICSA-21-105-01 Schneider Electric C-Bus Toolkit (Update A)

References

ICS Advisory ICSA-21-105-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-105-01
Recommended Practices
https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B