{"id":"CVE-2021-22817","aliases":["EUVD-2021-9952","GHSA-qhqr-hrxf-m49q"],"status":"published","title":"A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized...","description":"A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.002,"percentile":0.09938,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-276"],"published":"2022-02-09T22:05:12Z","modified":"2026-06-17T03:37:50Z","products":[{"vendor":"schneider-electric","product":"hmibmiea5dd1001_firmware"},{"vendor":"schneider-electric","product":"hmibmiea5dd100a_firmware"},{"vendor":"schneider-electric","product":"hmibmiea5dd1101_firmware"},{"vendor":"schneider-electric","product":"hmibmiea5dd110l_firmware"},{"vendor":"schneider-electric","product":"hmibmiea5dd1e01_firmware"},{"vendor":"schneider-electric","product":"hmibmo0a5dd1001_firmware"},{"vendor":"schneider-electric","product":"hmibmo0a5ddf101_firmware"},{"vendor":"schneider-electric","product":"hmibmo0a5ddf10a_firmware"},{"vendor":"schneider-electric","product":"hmibmoma5dd1101_firmware"},{"vendor":"schneider-electric","product":"hmibmoma5dd1e01_firmware"},{"vendor":"schneider-electric","product":"hmibmoma5ddf10l_firmware"},{"vendor":"schneider-electric","product":"hmibmp0i74d2001_firmware"},{"vendor":"schneider-electric","product":"hmibmp0i74d200a_firmware"},{"vendor":"schneider-electric","product":"hmibmp0i74d4001_firmware"},{"vendor":"schneider-electric","product":"hmibmp0i74d400a_firmware"},{"vendor":"schneider-electric","product":"hmibmp0i74de00a_firmware"},{"vendor":"schneider-electric","product":"hmibmp0i74di00a_firmware"},{"vendor":"schneider-electric","product":"hmibmphi74d2801_firmware"},{"vendor":"schneider-electric","product":"hmibmphi74d4801_firmware"},{"vendor":"schneider-electric","product":"hmibmpsi74d2801_firmware"},{"vendor":"schneider-electric","product":"hmibmpsi74d4801_firmware"},{"vendor":"schneider-electric","product":"hmibmu0i29d2001_firmware"},{"vendor":"schneider-electric","product":"hmibmu0i29d200a_firmware"},{"vendor":"schneider-electric","product":"hmibmu0i29d4001_firmware"},{"vendor":"schneider-electric","product":"hmibmu0i29d400a_firmware"},{"vendor":"schneider-electric","product":"hmibmu0i29de00a_firmware"},{"vendor":"schneider-electric","product":"hmibmu0i29di00a_firmware"},{"vendor":"schneider-electric","product":"hmibmuci29d2w01_firmware"},{"vendor":"schneider-electric","product":"hmibmuci29d4w01_firmware"},{"vendor":"schneider-electric","product":"hmibmuhi29d2801_firmware"},{"vendor":"schneider-electric","product":"hmibmuhi29d4801_firmware"},{"vendor":"schneider-electric","product":"hmibmusi29d2801_firmware"},{"vendor":"schneider-electric","product":"hmibmusi29d4801_firmware"},{"vendor":"schneider-electric","product":"hmibscea53d1l01_firmware"},{"vendor":"schneider-electric","product":"hmibscea53d1l0a_firmware"},{"vendor":"schneider-electric","product":"hmibscea53d1l0t_firmware"},{"vendor":"schneider-electric","product":"vijeo_designer"}],"references":[{"url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22817"},{"url":"https://github.com/advisories/GHSA-qhqr-hrxf-m49q"}],"sources":{"cve":[{"id":"CVE-2021-22817","description":"A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)","status":"published","published":"2022-02-09T22:05:12Z","modified":"2024-08-03T18:51:07.468Z","cwes":["CWE-276"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-9952","description":"A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)","status":"published","published":"2022-02-09T22:05:12Z","modified":"2024-08-03T18:51:07Z","updated_at":"2026-11-03T03:25:01.154097Z"}],"ghsa":[{"id":"GHSA-qhqr-hrxf-m49q","title":"A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized...","description":"A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)","status":"published","published":"2022-02-11T00:00:58Z","modified":"2023-02-03T05:05:59Z","cwes":["CWE-276"],"updated_at":"2026-11-02T14:53:49.735091Z"}],"nvd":[{"id":"CVE-2021-22817","description":"A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1)","status":"published","published":"2022-02-09T23:15:14.937Z","modified":"2026-06-17T03:37:50.883Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:07:04.6896Z"}]}}