First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2021-22795

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Schneider Electric	StruxureWare Data Center Expert	>= unspecified, < V7.8.1

References

Timeline

Published: Apr 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-227967.8A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected P CVE-2021-227977.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious scri CVE-2021-227987.5A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause Sensitive data such as login credentials being exposed CVE-2021-227993.8A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network CVE-2021-22807.1Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-228007.5A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial of Service when a crafted packet is sent to the controlle CVE-2021-228019.8A CWE-269: Improper Privilege Management vulnerability exists that could cause an arbitrary command execution when the software is configure CVE-2021-228029.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length CVE-2021-228039.8A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of CVE-2021-228047.5A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause disclosure of arbitrary files be CVE-2021-228059.1A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of CVE-2021-228067.5A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could cause data exfiltration and unauthorized access when

CVE-2021-22795: Critical severity, CVSS 9.8 | Vulnix