CVE-2021-22797: Schneider Electric Ecostruxure Control Expert

High severity, CVSS 7.8. EPSS: 26.1% chance of exploitation in the next 30 days.

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the engineering software. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior, including former Unity Pro), EcoStruxure Process Expert (2020 and prior, including former HDCS), SCADAPack RemoteConnect for x70 (All versions)

Affected products

• Schneider Electric Ecostruxure Control Expert: before 15.1 (fixed in 15.1)
• Schneider Electric Ecostruxure Process Expert: before 2021 (fixed in 2021)
• Schneider Electric Remoteconnect: affected versions not specified

Published 2022-04-13. Last modified 2026-06-17.