CVE-2021-22784

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-22784
A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker to use a crafted webpage to obtain remote access to the system.

5.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

3.5 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-04 Product Vendor Advisory
https://www.tenable.com/security/research/tra-2021-50 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:schneider-electric:c-bus_toolkit:*:*:*:*:*:*:*:*
History

31 Jan 2022, 19:33

Type Values Removed Values Added
CPE cpe:2.3:a:se:c-bus_toolkit:*:*:*:*:*:*:*:* cpe:2.3:a:schneider-electric:c-bus_toolkit:*:*:*:*:*:*:*:*
First Time Schneider-electric
Schneider-electric c-bus Toolkit

30 Nov 2021, 21:38

Type Values Removed Values Added
References (MISC) https://www.tenable.com/security/research/tra-2021-50 - (MISC) https://www.tenable.com/security/research/tra-2021-50 - Exploit, Third Party Advisory
CVSS v2 : 4.3
v3 : 6.5 		v2 : 3.5
v3 : 5.7

17 Nov 2021, 01:15

Type Values Removed Values Added
References
  • (MISC) https://www.tenable.com/security/research/tra-2021-50 -

27 Jul 2021, 19:33

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 4.3
v3 : 6.5
CWE CWE-306
CPE cpe:2.3:a:se:c-bus_toolkit:*:*:*:*:*:*:*:*
References (MISC) http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-04 - (MISC) http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-04 - Product, Vendor Advisory

21 Jul 2021, 15:21

Type Values Removed Values Added
New CVE
Information

Published : 2021-07-21 15:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-22784

Mitre link : CVE-2021-22784

CVE.ORG link : CVE-2021-22784

JSON object : View

Products Affected

schneider-electric

  • c-bus_toolkit
CWE
CWE-306

Missing Authentication for Critical Function