CVE-2021-22779

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*), that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-22784.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 anCVE-2021-227807.1Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versCVE-2021-227815.5Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versCVE-2021-227825.5Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versCVE-2021-227837.6A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. CVE-2021-227845.7A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attackerCVE-2021-227857.5A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leCVE-2021-227867.5A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the contCVE-2021-227877.5A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a speciallyCVE-2021-227887.5A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP requeCVE-2021-227896.5A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on theCVE-2021-22798.1Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio
CVE-2021-22779: Critical severity, CVSS 9.1 | Vulnix