CVE-2021-22797

HIGH

7.8

CVSS Score

Published: March 28, 2022 at 04:25 PM UTC

Updated: June 17, 2026 at 03:37 AM UTC

8 products affected across 1 vendorEcoStruxure Control ExpertEcoStruxure Process ExpertRemoteConnect

Using EcoStruxure Control Expert by Schneider Electric?

Get instant alerts when new vulnerabilities affect EcoStruxure Control Expert - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 26%

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the engineering software. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior, including former Unity Pro), EcoStruxure Process Expert (2020 and prior, including former HDCS), SCADAPack RemoteConnect for x70 (All versions)

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

EcoStruxure Control Expert · Schneider Electric

95%

v < 15.1v < V15.0 SP1

Affected range stops below 15.1, so it looks safe — our inference, not a vendor statement

Affected range stops below V15.0 SP1, so it looks safe — our inference, not a vendor statement

EcoStruxure Process Expert · Schneider Electric

95%

v < 2020v < 2021

Affected range stops below 2020, so it looks safe — our inference, not a vendor statement

Affected range stops below 2021, so it looks safe — our inference, not a vendor statement

RemoteConnect · Schneider Electric

95%

All versions

schneider-electric-scadapack-470 (environment) · schneider-electric-scadapack-474 (environment) · schneider-electric-scadapack-570 (environment) · schneider-electric-scadapack-574 (environment) · schneider-electric-scadapack-575 (environment)

Scadapack 470 · Schneider Electricdevice

80%

All versions

Scadapack 474 · Schneider Electricdevice

80%

All versions

Scadapack 570 · Schneider Electricdevice

80%

All versions

Scadapack 574 · Schneider Electricdevice

80%

All versions