CVE-2021-22772CWE-306

A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104)…

published July 21, 2021

CVSS
—
EPSS
2%
Percentile
74.7
In the wild
Unconfirmed
What it is

⚠️ A missing authentication bug means anyone could take control! The Easergy T200 device leaves critical functions wide open, just waiting for the right mischief-maker. 🔓 Think of it like a restaurant where anyone can waltz into the kitchen without a badge, changing orders and recipes without anyone batting an eye. It’s chaos waiting to happen! If this vulnerability is exploited, an unauthorized user could manipulate critical functions of the Easergy T200, potentially leading to significant disruptions in control systems. Imagine a rogue chef ruining the dinner service by changing every order—they'd wreak havoc before anyone noticed!

Put simply

Think of it like a restaurant where anyone can waltz into the kitchen without a badge, changing orders and recipes without anyone batting an eye. It’s chaos waiting to happen! The vulnerability arises from inadequate authentication checks that allow unauthorized access to critical functionalities within the Easergy T200 devices (Modbus, IEC104, and DNP3 protocols). This flaw can permit attackers to bypass security measures and execute unauthorized operations.

What to do

If this vulnerability is exploited, an unauthorized user could manipulate critical functions of the Easergy T200, potentially leading to significant disruptions in control systems. Imagine a rogue chef ruining the dinner service by changing every order—they'd wreak havoc before anyone noticed! To remediate this vulnerability, ensure that all Easergy T200 devices are updated to the latest firmware versions: SC2-04MOD-07000101, SC2-04IEC-07000101, and SC2-04DNP-07000103 or later. Additionally, review and enhance authentication mechanisms to secure critical functions. You’ve got this! With a few updates, you can safeguard your devices and be the hero of security. 🦸‍♂️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01541 · 74.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2021-07-21T10:41Z
EPSS history
Timeline
  • 21 JUL 10:41Z
    A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104)…
    cvelistv5