CVE-2021-22793 - Vulnerability Details - OpenCVE

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4) that could allow an authenticated attacker to access the device via FTP protocol.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00544.

Key SSVC decision points have not yet been added.

Vendors	Products
Schneider-electric	Accusine Pcs\+ Accusine Pcsn Accusine Pcsn Active Harmonic Filter Firmware Accusine Pcsp Pfvp Firmware Accusine Pfv\+

Configuration 1 [-]

AND

cpe:2.3:o:schneider-electric:accusine_pcsp_pfvp_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:schneider-electric:accusine_pcs\+:-:::::::*
	cpe:2.3:h:schneider-electric:accusine_pfv\+:-:::::::*

Configuration 2 [-]

AND

cpe:2.3:o:schneider-electric:accusine_pcsn_active_harmonic_filter_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:accusine_pcsn:-:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-05

History

No history.

MITRE

Status: PUBLISHED

Assigner: schneider

Published: 2021-09-02T16:53:17

Updated: 2024-08-03T18:51:07.470Z

Reserved: 2021-01-06T00:00:00

Link: CVE-2021-22793

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-09-02T17:15:08.393

Modified: 2024-11-21T05:50:40.907

Link: CVE-2021-22793

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4)", "vendor": "n/a", "versions": [{"status": "affected", "version": "AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4)"}]}], "descriptions": [{"lang": "en", "value": "A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4) that could allow an authenticated attacker to access the device via FTP protocol."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-09-02T16:53:17", "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cybersecurity@schneider-electric.com", "ID": "CVE-2021-22793", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4)", "version": {"version_data": [{"version_value": "AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4)"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4) that could allow an authenticated attacker to access the device via FTP protocol."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}]}, "references": {"reference_data": [{"name": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01", "refsource": "MISC", "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:51:07.470Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"}]}]}, "cveMetadata": {"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "assignerShortName": "schneider", "cveId": "CVE-2021-22793", "datePublished": "2021-09-02T16:53:17", "dateReserved": "2021-01-06T00:00:00", "dateUpdated": "2024-08-03T18:51:07.470Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:accusine_pcsp_pfvp_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "983C00E2-0BEF-484B-9D03-B87DE6CD77C1", "versionEndExcluding": "001.006.007", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:accusine_pcs\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "3C31460D-46C2-4F3E-8DDB-98816B74EFB1", "vulnerable": false}, {"criteria": "cpe:2.3:h:schneider-electric:accusine_pfv\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "E3904B69-F4E3-4D69-A3C9-1F5201455745", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:accusine_pcsn_active_harmonic_filter_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D69A10A-19FE-4485-AD03-7F3506D2D0E5", "versionEndExcluding": "002.002.004", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:accusine_pcsn:-:*:*:*:*:*:*:*", "matchCriteriaId": "5FEFEF03-5CD7-498F-A538-928AA1D62F45", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4) that could allow an authenticated attacker to access the device via FTP protocol."}, {"lang": "es", "value": "Una CWE-200: Una vulnerabilidad de Exposici\u00f3n de Informaci\u00f3n Confidencial a un Actor no Autorizado en AccuSine PCS+ / PFV+ (versiones anteriores a V1.6.7) y AccuSine PCSn (versiones anteriores a V2.2.4) que podr\u00eda permitir a un atacante autenticado acceder al dispositivo por medio del protocolo FTP"}], "id": "CVE-2021-22793", "lastModified": "2024-11-21T05:50:40.907", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-09-02T17:15:08.393", "references": [{"source": "cybersecurity@se.com", "tags": ["Not Applicable"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"}, {"source": "nvd@nist.gov", "tags": ["Patch", "Vendor Advisory"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-05"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-01"}], "sourceIdentifier": "cybersecurity@se.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "cybersecurity@se.com", "type": "Secondary"}]}