CVE-2021-22772
Critical
Description
A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104) SC2-04IEC-07000100 and earlier), and Easergy T200 ((DNP3) SC2-04DNP-07000102 and earlier) that could cause unauthorized operation when authentication is bypassed.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSchneider-electric T200i Firmware
PublishedJul 21, 2021
First seenJul 21, 2021
Weakness typeCWE-306Missing authentication for critical function
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric t200i_firmware | v ≤ sc2-04mod-07000100, v ≤ sc2-04iec-07000100, v ≤ sc2-04dnp-07000102 | — |
| schneider-electric t200e_firmware | v ≤ sc2-04mod-07000100, v ≤ sc2-04iec-07000100, v ≤ sc2-04dnp-07000102 | — |
| schneider-electric t200p_firmware | v ≤ sc2-04mod-07000100, v ≤ sc2-04iec-07000100, v ≤ sc2-04dnp-07000102 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.