1. Home
  2. CVE Database
  3. CVE-2021-22799
LOW · 3.8

CVE-2021-22799

A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password ...

Vulnerability Description

A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password from the registry. Affected Product: Schneider Electric Software Update, V2.3.0 through V2.5.1

CVSS Score

3.8

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Schneider-ElectricSoftware Update>= 2.3.0, < 2.5.2

Related Weaknesses (CWE)

CWE-331

References

FAQ

What is CVE-2021-22799?

CVE-2021-22799 is a vulnerability with a CVSS score of 3.8 (LOW). A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password ...

How severe is CVE-2021-22799?

CVE-2021-22799 has been rated LOW with a CVSS base score of 3.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-22799?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Software Update.