Critical ICSA-21-257-03 2 CVEs

Schneider Electric Struxureware Data Center Expert

Published Sep 14, 2021 · Updated Sep 14, 2021

Vendor: Schneider Electric Product: Struxureware Data Center

Summary

Successful exploitation of these vulnerabilities could allow remote code execution.

Vulnerabilities 2

Critical 9.1

CVE-2021-22794

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Mar 28, 2022
Critical 9.1

CVE-2021-22795

A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exist…

Schneider Electric StruxureWare Data Center Expert ICS / OT

Mar 28, 2022

Revision history

2021-09-14 #1
ICSA-21-257-03 Schneider Electric Struxureware Data Center Expert

References

ICS Advisory ICSA-21-257-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-257-03
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B