Skip to content
Fencer Vulns
medium 5.5

CVE-2021-22782 json

Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all ver…

published 2021-07-14 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-9917

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions, that could cause an information leak allowing disclosure of network and process information, credentials or intellectual property when an attacker can access a project file.

Patch / fix

  • schneider-electric ecostruxure_control_expert 15.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-194-02 updated cvss 6.2

Schneider Electric Modicon Controllers and Software (Update A)

  • Schneider Electric Software, LLC EcoStruxure Control Expert 15.0 SP1, < 15.0 SP1 Schneider Electric Software, LLC EcoStruxure Process Expert Schneider Electric Software, LLC Modicon M340 CPU (part numbers BMXP34*) Schneider Electric Software, LLC Modicon M580 CPU (part numbers BMEP* and BMEH*) Schneider Electric Software, LLC SCADAPack RemoteConnect for x70
    affected: mitigation

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions

Classification

Weakness
  • CWE-311 Missing Encryption of Sensitive Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.