^{CVE-2021-22772:}Authentication Bypass in Schneider Electric Easergy T200 Devices

Overview

The vulnerability exists in Schneider Electric Easergy T200 devices running firmware versions SC2-04MOD-07000100 and earlier (Modbus protocol), SC2-04IEC-07000100 and earlier (IEC104 protocol), and SC2-04DNP-07000102 and earlier (DNP3 protocol). The issue stems from a missing authentication mechanism for critical functions, allowing potential attackers to bypass security controls and execute unauthorized operations. This type of vulnerability is particularly concerning in industrial environments where Easergy T200 devices are commonly deployed for remote terminal unit (RTU) functions in electrical distribution networks. Unauthorized access could potentially lead to disruption of electrical distribution systems or unauthorized control of connected equipment.

Remediation

1. Update affected Easergy T200 devices to the latest firmware versions as recommended by Schneider Electric in their security advisory.
2. If immediate updates are not possible, implement network segmentation to isolate affected devices.
3. Restrict network access to the devices using firewalls and access control lists.
4. Monitor network traffic to and from these devices for suspicious activities.
5. Implement additional authentication mechanisms at the network level where possible.
6. Follow Schneider Electric's specific remediation guidance provided in their security advisory (SEVD-2021-194-05).
7. Conduct a security assessment to identify any signs of compromise if these devices have been exposed.

References

1. Schneider Electric Security Advisory: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-05
2. CWE-306: Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
3. MITRE CVE-2021-22772: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22772
4. Schneider Electric Easergy T200 Product Information: https://www.se.com/ww/en/product-range/61915-easergy-t200/