CVE-2021-22799

Severity: low (CVSS 3.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-28 · updated 2026-06-17
Weakness: CWE-331

Description

A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password from the registry. Affected Product: Schneider Electric Software Update, V2.3.0 through V2.5.1

Affected products

Schneider Electric Software Update (SESU) – SUT Service component: from 2.3.0 before 2.5.2 — fixed in 2.5.2

How to fix

Upgrade to a fixed version: Schneider Electric Software Update (SESU) – SUT Service component 2.5.2. Check the vendor advisory for mitigations.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-02
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-02

Get alerted when CVE-2021-22799 or the next vulnerability affects your stack