CVE-2021-22731: Schneider Electric MCSESM043F23F0 Firmware

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

Affected products

• Schneider Electric MCSESM043F23F0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM053F1CS0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM053F1CU0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM063F2CS0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM063F2CU0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM083F23F0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM083F23F0H Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM093F1CS0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM093F1CU0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM103F2CS0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM103F2CS0H Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM103F2CU0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM103F2CU0H Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESM123F2LG0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESP083F23G0 Firmware: before 8.22 (fixed in 8.22)
• Schneider Electric MCSESP083F23G0T Firmware: before 8.22 (fixed in 8.22)

Published 2021-05-26. Last modified 2026-06-17.