CVE-2021-22788 HIGH

Published: 2022-02-11 | Last Modified: 2026-05-29 | Status: Modified

Description

A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)

Additional Descriptions (1)

Una CWE-787: Se presenta una vulnerabilidad de Escritura Fuera de Límites que podría causar una denegación de servicio cuando un atacante envía una petición HTTP especialmente diseñada al servidor web del dispositivo. Producto afectado: CPUs Modicon M340: BMXP34 (Versiones anteriores a V3.40), Módulos de Comunicación Ethernet Modicon M340 X80: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (Todas las versiones), Procesadores Modicon Premium con Ethernet integrada (Copro): TSXP574634, TSXP575634, TSXP576634 (Todas las versiones), Procesadores Modicon Quantum con Ethernet integrado (Copro): 140CPU65xxxxx (Todas las versiones), Módulos de comunicación Modicon Quantum: 140NOE771x1, 140NOC78x00, 140NOC77101 (Todas las versiones), Módulos de comunicación Modicon Premium: TSXETY4103, TSXETY5103 (todas las versiones)

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-787
[email protected]	Primary	en CWE-787

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_m340_bmxp342020_firmware	*	<built-in method update of dict object at 0x7e60a8be5f80>	Operating System
schneider-electric	bmxnoe0100_firmware	*	<built-in method update of dict object at 0x7e60b9fb4c80>	Operating System
schneider-electric	bmxnoe0110_firmware	*	<built-in method update of dict object at 0x7e60b9fb5f40>	Operating System
schneider-electric	bmxnoc0401_firmware	*	<built-in method update of dict object at 0x7e60b9fb6b80>	Operating System
schneider-electric	bmxnor0200h_rtu_firmware	*	<built-in method update of dict object at 0x7e60a8be5080>	Operating System
schneider-electric	tsxp574634_firmware	*	<built-in method update of dict object at 0x7e60b9fb6d40>	Operating System
schneider-electric	tsxp575634_firmware	*	<built-in method update of dict object at 0x7e60a8be73c0>	Operating System
schneider-electric	tsxp576634_firmware	*	<built-in method update of dict object at 0x7e60a8be4540>	Operating System
schneider-electric	140cpu65150_firmware	*	<built-in method update of dict object at 0x7e60a8be6e40>	Operating System
schneider-electric	140noe771x1_firmware	*	<built-in method update of dict object at 0x7e60a8be5e40>	Operating System
schneider-electric	140noc78x00_firmware	*	<built-in method update of dict object at 0x7e60a8be5340>	Operating System
schneider-electric	140noc77101_firmware	*	<built-in method update of dict object at 0x7e60a8be59c0>	Operating System
schneider-electric	tsxety4103_firmware	*	<built-in method update of dict object at 0x7e60eb24ed40>	Operating System
schneider-electric	tsxety5103_firmware	*	<built-in method update of dict object at 0x7e60eb24e300>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:bmxnoe0100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:bmxnoe0100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:bmxnoe0110_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:bmxnoe0110:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:bmxnoc0401_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:bmxnoc0401:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:bmxnor0200h_rtu_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:bmxnor0200h_rtu:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tsxp574634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tsxp574634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tsxp575634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tsxp575634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tsxp576634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tsxp576634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:140cpu65150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:140cpu65150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:140noe771x1_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:140noe771x1:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:140noc78x00_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:140noc78x00:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:140noc77101_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:140noc77101:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tsxety4103_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tsxety4103:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:tsxety5103_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:tsxety5103:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02
Source: [email protected]

Patch Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02
Source: af854a3a-2127-422b-91ae-364da2661108

Patch Vendor Advisory