CVE-2021-22704

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-02 · updated 2026-06-17
Weakness: CWE-22

Description

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.

Affected products

Schneider-Electric Ecostruxure Machine Expert: before 2.0; 2.0 — fixed in 2.0
Schneider Electric Vijeo Designer: before 6.2.11; before 1.2 — fixed in 1.2, 6.2.11

How to fix

Upgrade to a fixed version: Schneider-Electric Ecostruxure Machine Expert 2.0; Schneider Electric Vijeo Designer 1.2, 6.2.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22704 or the next vulnerability affects your stack