Severity

High

Analysis Summary

CVE-2021-22769

This vulnerability may allow disclosure of device configuration information to any authenticated user when a specially crafted request is sent to the device. Successful exploitation of this vulnerability could allow the elevation of privileges, which could result in unintended disclosure of device configuration information to any authenticated user.

Impact

• Information Disclosure
• Improper Privilege Management

Affected Vendors

Schneider Electric

Affected Products

Enerlin’X Com’X 510: All versions prior to v6.8.4

Remediation

Refer to vendor advisory for the complete list of affected products and their respective patches at https://us-cert.cisa.gov/ics/advisories/icsa-21-168-01