What is the CVSS score of CVE-2021-22731?

CVE-2021-22731 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.4%.

Is there a patch available for CVE-2021-22731?

Yes, a patch is available for CVE-2021-22731. Update the affected software to the latest version immediately.

Mcsesp083F23G0 Firmware CVE-2021-22731

CRITICAL

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2021-05-26 cybersecurity@se.com

Authentication Bypass Mcsesp083F23G0 Firmware Mcsesp083F23G0T Firmware Mcsesm043F23F0 Firmware Mcsesm053F1Cu0 Firmware Mcsesm063F2Cu0 Firmware Mcsesm053F1Cs0 Firmware Mcsesm063F2Cs0 Firmware Mcsesm083F23F0 Firmware Mcsesm103F2Cu0 Firmware Mcsesm083F23F0H Firmware Mcsesm103F2Cu0H Firmware Mcsesm103F2Cs0H Firmware Mcsesm123F2Lg0 Firmware Mcsesm093F1Cu0 Firmware Mcsesm093F1Cs0 Firmware Mcsesm103F2Cs0 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 26, 2021 - 20:15 nvd

CRITICAL 9.8

DescriptionNVD

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

AnalysisAI

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-640. Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker. Affected products include: Schneider-Electric Mcsesp083F23G0 Firmware, Schneider-Electric Mcsesp083F23G0T Firmware, Schneider-Electric Mcsesm043F23F0 Firmware, Schneider-Electric Mcsesm053F1Cu0 Firmware, Schneider-Electric Mcsesm063F2Cu0 Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.