CVE-2021-22775

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A CWE-427: Uncontrolled Search Path Element vulnerability exists in GP-Pro EX,V4.09.250 and prior, that could cause local code execution with elevated privileges when installing the software.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
n/a	GP-Pro EX V4.09.250 and prior	GP-Pro EX V4.09.250 and prior

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-03Patch, Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-03Patch, Vendor Advisory

Timeline

Published: Sep 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-227777.8A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file.CVE-2021-227787.1Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers CVE-2021-227799.1Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all version CVE-2021-22784.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 an CVE-2021-227807.1Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers CVE-2021-227815.5Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers CVE-2021-227825.5Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers CVE-2021-227837.6A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. CVE-2021-227845.7A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker CVE-2021-227857.5A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to le CVE-2021-227867.5A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the cont CVE-2021-227877.5A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially