CVE-2021-22697

HIGH 7.8CVE-2021-22697 · Published 26/01/2021 · updated 17/06/2026

In short

CVE-2021-22697 is a HIGH (CVSS 7.8) vulnerability affecting ecostruxure power build - rapsody (schneider-electric).
Chance of exploitation in the next 30 days (EPSS): 3.6%, higher than 89.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ecostruxure power build - rapsody schneider-electric	`≤ 2.1.13`	No fix yet

Description

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.

References

us-cert.cisa.gov/ics/advisories/icsa-21-012-01 · Third Party Advisory
se.com/ww/en/download/document/SEVD-2021-012-02 · Vendor Advisory
zerodayinitiative.com/advisories/ZDI-21-186 · Third Party Advisory

More vulnerabilities in ecostruxure power build - rapsody

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ecostruxure power build - rapsody

schneider-electric

≤ 2.1.13

No fix yet

More vulnerabilities in ecostruxure power build - rapsody

See all →