CVE-2021-22661

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be changed by a user or external process without knowledge of the current password on the ICX35-HWC-A and ICX35-HWC-E (Versions 1.9.62 and prior).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	ICX35-HWC-A, ICX35-HWC-E	Versions 1.9.62 and prior

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-056-04Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-056-04Third Party Advisory, US Government Resource

Timeline

Published: Feb 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-226627.8A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, CVE-2021-226637.8Cscape (All versions prior to 9.90 SP3.5) lacks proper validation of user-supplied data when parsing project files. This could lead to an ou CVE-2021-226647.8CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.CVE-2021-226657.8Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with lim CVE-2021-226667.8Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing a CVE-2021-226679.8BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain un CVE-2021-226689.8Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-b CVE-2021-226698.8Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and pr CVE-2021-22678.1Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: User Interface). Supported versions that are a CVE-2021-226707.8An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, al CVE-2021-226719.8Multiple integer overflow issues exist while processing long domain names, which may allow an attacker to remotely execute code on the Simpl CVE-2021-226727.8Delta Electronics' CNCSoft ScreenEditor in versions prior to v1.01.30 could allow the corruption of data, a denial-of-service condition, or