CVE-2021-22807
📋 TL;DR
This vulnerability allows arbitrary code execution when a malicious *.gd1 configuration file is loaded into the Eurotherm GUIcon tool. Attackers could gain full control of affected systems by tricking users into opening specially crafted files. Affects Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) and prior versions.
💻 Affected Systems
- Eurotherm by Schneider Electric GUIcon
📦 What is this software?
Guicon by Schneider Electric
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining administrative privileges, installing persistent malware, and pivoting to other systems.
Likely Case
Local privilege escalation leading to industrial control system disruption, data theft, or ransomware deployment.
If Mitigated
Limited impact if systems are air-gapped, users are trained not to open untrusted files, and proper access controls are implemented.
🎯 Exploit Status
Requires user interaction to open malicious file. No public exploit code available as of knowledge cutoff.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.0 (Build 683.004) or later
Vendor Advisory: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07
Restart Required: Yes
Instructions:
1. Download updated version from Schneider Electric portal. 2. Backup existing configurations. 3. Uninstall old version. 4. Install new version. 5. Restart system. 6. Restore configurations.
🔧 Temporary Workarounds
Restrict *.gd1 file handling
windowsConfigure Windows to open *.gd1 files with a text editor instead of GUIcon by default
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .gd1 > Change program > Choose Notepad or other text editor
Application whitelisting
windowsUse AppLocker or similar to restrict GUIcon execution to trusted directories only
🧯 If You Can't Patch
- Implement strict user training: Never open *.gd1 files from untrusted sources
- Network segmentation: Isolate systems running GUIcon from general corporate network
🔍 How to Verify
Check if Vulnerable:
Check GUIcon version in Help > About. If version is 2.0 (Build 683.003) or earlier, system is vulnerable.Check Version:
Check GUIcon application properties or Help > About menuVerify Fix Applied:
Verify GUIcon version shows 2.0 (Build 683.004) or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing GUIcon crashes
- Application logs showing unexpected *.gd1 file loads
Network Indicators:
- Unusual outbound connections from engineering workstations
- File transfers of *.gd1 files to unexpected systems
SIEM Query:
source="Windows Security" EventCode=4688 ProcessName="*GUIcon*" OR source="Application" Message="*gd1*"