CVE-2021-22741: schneider-electric ecostruxure_geo_scada_expert_2020

Vulnerability summary

CVE-2021-22741 is a medium (CVSS 6.7) vulnerability in schneider-electric ecostruxure_geo_scada_expert_2020. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities.

Timeline

1. 26-05-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure Geo SCADA Expert 2020 (V83.7742.1 and prior), which could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account password hashes.

• CWE-916Use of Password Hash With Insufficient Computational EffortThe product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.