Skip to content
Fencer Vulns
high 7.1

CVE-2021-22780 json

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all ver…

published 2021-07-14 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-9915

cvss
7.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause unauthorized access to a project file protected by a password when this file is shared with untrusted sources. An attacker may bypass the password protection and be able to view and modify a project file.

Patch / fix

  • schneider-electric ecostruxure_control_expert 15.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-194-02 updated cvss 7.1

Schneider Electric Modicon Controllers and Software (Update A)

  • Schneider Electric Software, LLC EcoStruxure Control Expert 15.0 SP1, < 15.0 SP1 Schneider Electric Software, LLC EcoStruxure Process Expert Schneider Electric Software, LLC Modicon M340 CPU (part numbers BMXP34*) Schneider Electric Software, LLC Modicon M580 CPU (part numbers BMEP* and BMEH*) Schneider Electric Software, LLC SCADAPack RemoteConnect for x70
    affected: mitigation

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 3.6 AV:L/AC:L/Au:N/C:P/I:P/A:N

Affected products

  • n/a EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.