CVE-2021-22771

low-risk
Published 2021-07-21

A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmware V2.7.1 and older that would allow arbitrary command execution.

Do I need to act?

-
0.29% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.3/10 High
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Schneider-Electric

References (2)

Vendor Advisory http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-02
Vendor Advisory http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-02
29
/ 100
low-risk
Severity 23/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal