CVE-2021-22704: Schneider Electric Ecostruxure Machine Expert

Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days.

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.

Affected products

• Schneider Electric Ecostruxure Machine Expert: before 2.0 (fixed in 2.0); version 2.0 only
• Schneider Electric Vijeo Designer: before 6.2.11 (fixed in 6.2.11); before 1.2 (fixed in 1.2)

Published 2021-09-02. Last modified 2026-06-17.