CVE-2021-22816

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-28 · updated 2026-06-17
Weakness: CWE-754

Description

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a Denial of Service of the RTU when receiving a specially crafted request over Modbus, and the RTU is configured as a Modbus server. Affected Products: SCADAPack 312E, 313E, 314E, 330E, 333E, 334E, 337E, 350E and 357E RTUs with firmware V8.18.1 and prior

Affected products

Schneider-Electric Scadapack 312E Firmware: before 8.19.1 — fixed in 8.19.1
Schneider-Electric Scadapack 313E Firmware: before 8.19.1 — fixed in 8.19.1
Schneider-Electric Scadapack 314E Firmware: before 8.19.1 — fixed in 8.19.1
Schneider-Electric Scadapack 330E Firmware: before 8.19.1 — fixed in 8.19.1
Schneider-Electric Scadapack 333E Firmware: before 8.19.1 — fixed in 8.19.1
Schneider-Electric Scadapack 334E Firmware: before 8.19.1 — fixed in 8.19.1
Schneider-Electric Scadapack 337E Firmware: before 8.19.1 — fixed in 8.19.1
Schneider-Electric Scadapack 350E Firmware: before 8.19.1 — fixed in 8.19.1
Schneider-Electric Scadapack 357E Firmware: before 8.19.1 — fixed in 8.19.1

How to fix

Upgrade to a fixed version: Schneider-Electric Scadapack 312E Firmware 8.19.1; Schneider-Electric Scadapack 313E Firmware 8.19.1; Schneider-Electric Scadapack 314E Firmware 8.19.1; Schneider-Electric Scadapack 330E Firmware 8.19.1; Schneider-Electric Scadapack 333E Firmware 8.19.1; Schneider-Electric Scadapack 334E Firmware 8.19.1; Schneider-Electric Scadapack 337E Firmware 8.19.1; Schneider-Electric Scadapack 350E Firmware 8.19.1; Schneider-Electric Scadapack 357E Firmware 8.19.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-22816 or the next vulnerability affects your stack