CVE-2021-22781

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause a leak of SMTP credential used for mailbox authentication when an attacker can access a project file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Jul 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-227825.5Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers CVE-2021-227837.6A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. CVE-2021-227845.7A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker CVE-2021-227857.5A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to le CVE-2021-227867.5A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the cont CVE-2021-227877.5A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially CVE-2021-227887.5A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP reque CVE-2021-227896.5A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the CVE-2021-22798.1Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-227906.5A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the CVE-2021-227916.5A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating th CVE-2021-227927.5A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updati