CVE-2021-22731

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-26 · updated 2026-06-17
Weakness: CWE-640

Description

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

Affected products

Schneider-Electric Mcsesm043F23F0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm053F1Cs0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm053F1Cu0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm063F2Cs0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm063F2Cu0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm083F23F0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm083F23F0H Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm093F1Cs0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm093F1Cu0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm103F2Cs0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm103F2Cs0H Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm103F2Cu0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm103F2Cu0H Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesm123F2Lg0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesp083F23G0 Firmware: before 8.22 — fixed in 8.22
Schneider-Electric Mcsesp083F23G0T Firmware: before 8.22 — fixed in 8.22

How to fix

Upgrade to a fixed version: Schneider-Electric Mcsesm043F23F0 Firmware 8.22; Schneider-Electric Mcsesm053F1Cs0 Firmware 8.22; Schneider-Electric Mcsesm053F1Cu0 Firmware 8.22; Schneider-Electric Mcsesm063F2Cs0 Firmware 8.22; Schneider-Electric Mcsesm063F2Cu0 Firmware 8.22; Schneider-Electric Mcsesm083F23F0 Firmware 8.22; Schneider-Electric Mcsesm083F23F0H Firmware 8.22; Schneider-Electric Mcsesm093F1Cs0 Firmware 8.22; Schneider-Electric Mcsesm093F1Cu0 Firmware 8.22; Schneider-Electric Mcsesm103F2Cs0 Firmware 8.22; Schneider-Electric Mcsesm103F2Cs0H Firmware 8.22; Schneider-Electric Mcsesm103F2Cu0 Firmware 8.22. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22731 or the next vulnerability affects your stack