Skip to content
OpenAdvisories
Critical ICSA-22-223-03 13 CVEs

Schneider Electric EcoStruxure, EcoStruxure Process Expert, SCADAPack RemoteConnect for x70

Published Aug 11, 2022 · Updated Aug 11, 2022

Vendor: Schneider Electric Product: EcoStruxure Control Expert Product: EcoStruxure™ Process Expert Product: SCADAPack RemoteConnect for x70

Summary

The successful exploitation of these vulnerabilities on the affected products could lead to the execution of malicious files, which could result in code execution with elevated privileges.

Vulnerabilities 13

  • High 8.1
    CVE-2021-21810

    A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A speci…

  • High 8.1
    CVE-2021-21811

    A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. …

  • High 8.1
    CVE-2021-21825

    A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functi…

  • High 8.1
    CVE-2021-21826

    A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs X…

  • High 8.1
    CVE-2021-21827

    A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs X…

  • High 8.1
    CVE-2021-21828

    A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs X…

  • High 8.1
    CVE-2021-21829

    A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem func…

  • High 8.1
    CVE-2021-21830

    A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ …

  • High 7.8
    CVE-2021-21812

    A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs…

  • High 7.8
    CVE-2021-21813

    Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the comma…

  • High 7.8
    CVE-2021-21814

    Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the comma…

  • High 7.8
    CVE-2021-21815

    A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs…

  • Unscored —
    CVE-2022-26507

    A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file c…

Revision history

  1. #1

    Publication Date

References