Cyber Resilience

CVE-2021-22731

Critical

Published: 26 May 2021

Published
26 May 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0088 75.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-22731 is a critical-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Schneider-Electric Mcsesp083F23G0 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 24.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

CWE(s)
CWE-640

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

schneider-electric
mcsesp083f23g0 firmware
≤ 8.22
schneider-electric
mcsesp083f23g0t firmware
≤ 8.22
schneider-electric
mcsesm043f23f0 firmware
≤ 8.22
schneider-electric
mcsesm053f1cu0 firmware
≤ 8.22
schneider-electric
mcsesm063f2cu0 firmware
≤ 8.22
schneider-electric
mcsesm053f1cs0 firmware
≤ 8.22
schneider-electric
mcsesm063f2cs0 firmware
≤ 8.22
schneider-electric
mcsesm083f23f0 firmware
≤ 8.22
schneider-electric
mcsesm103f2cu0 firmware
≤ 8.22
schneider-electric
mcsesm083f23f0h firmware
≤ 8.22
+6 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

IA-5 Authenticator Management
addresses: CWE-640

Establishing procedures for lost or compromised authenticators addresses weak password recovery mechanisms.

References