CVE-2021-22698
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected systems by uploading a malicious SSD file. It affects EcoStruxure Power Build - Rapsody software users running version 2.1.13 or earlier. Attackers can exploit this without authentication to gain full control of the system.
💻 Affected Systems
- EcoStruxure Power Build - Rapsody
📦 What is this software?
Ecostruxure Power Build Rapsody by Schneider Electric
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to disrupt operations, steal sensitive engineering data, or deploy ransomware.
If Mitigated
File upload attempts blocked at network perimeter, preventing exploitation even if software remains vulnerable.
🎯 Exploit Status
ZDI-21-187 advisory includes technical details. The vulnerability requires only file upload capability, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.1.14 or later
Vendor Advisory: https://www.se.com/ww/en/download/document/SEVD-2021-012-02/
Restart Required: Yes
Instructions:
1. Download the updated version from Schneider Electric's official portal. 2. Backup current configuration and data. 3. Install the update following vendor instructions. 4. Restart the system. 5. Verify the update was successful.
🔧 Temporary Workarounds
Restrict SSD File Uploads
allBlock upload of SSD files at network perimeter or application level
Network Segmentation
allIsolate Rapsody systems from untrusted networks and internet
🧯 If You Can't Patch
- Implement strict network access controls to limit who can upload files to the system
- Deploy application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check software version in Help > About menu. If version is 2.1.13 or earlier, system is vulnerable.Check Version:
Not applicable - check through application GUIVerify Fix Applied:
Verify version is 2.1.14 or later in Help > About menu. Test SSD file upload functionality with safe test files.📡 Detection & Monitoring
Log Indicators:
- Failed or successful SSD file uploads from unusual sources
- Process creation events from Rapsody with unusual parameters
Network Indicators:
- HTTP POST requests with .ssd file extensions to Rapsody endpoints
- Outbound connections from Rapsody to unknown IPs
SIEM Query:
source="Rapsody" AND (event="file_upload" OR event="process_create")🔗 References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01
- https://www.se.com/ww/en/download/document/SEVD-2021-012-02/
- https://www.zerodayinitiative.com/advisories/ZDI-21-187/
- https://us-cert.cisa.gov/ics/advisories/icsa-21-012-01
- https://www.se.com/ww/en/download/document/SEVD-2021-012-02/
- https://www.zerodayinitiative.com/advisories/ZDI-21-187/
