CVE-2022-0222 HIGH

Published: 2022-11-22 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24)

Additional Descriptions (1)

Existe una vulnerabilidad CWE-269: Gestión de privilegios inadecuada que podría provocar una Denegación de Servicio (DoS) de la comunicación Ethernet del controlador al enviar una solicitud específica a través de SNMP. Productos afectados: CPU Modicon M340 (versiones BMXP34* anteriores a V3.40), módulos de comunicación Ethernet Modicon M340 X80: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU (BMXNOE* todas las versiones) (versiones BMXNOR* anteriores a v1. 7IR24)

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-269
[email protected]	Primary	en CWE-269

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_m340_bmxp341000_firmware	*	<built-in method update of dict object at 0x7e60a8a57c80>	Operating System
schneider-electric	modicon_m340_bmxp342000_firmware	*	<built-in method update of dict object at 0x7e60eb2e2d80>	Operating System
schneider-electric	modicon_m340_bmxp342010_firmware	*	<built-in method update of dict object at 0x7e60a8a54240>	Operating System
schneider-electric	modicon_m340_bmxp3420102_firmware	*	<built-in method update of dict object at 0x7e60ba2a6b40>	Operating System
schneider-electric	modicon_m340_bmxp342020_firmware	*	<built-in method update of dict object at 0x7e60a8a54b40>	Operating System
schneider-electric	modicon_m340_bmxp342020h_firmware	*	<built-in method update of dict object at 0x7e60a8a57300>	Operating System
schneider-electric	modicon_m340_bmxp342030_firmware	*	<built-in method update of dict object at 0x7e613c380140>	Operating System
schneider-electric	modicon_m340_bmxp3420302_firmware	*	<built-in method update of dict object at 0x7e6071eace80>	Operating System
schneider-electric	modicon_m340_bmxp3420302h_firmware	*	<built-in method update of dict object at 0x7e60ba2a65c0>	Operating System
schneider-electric	modicon_m340_bmxp342030h_firmware	*	<built-in method update of dict object at 0x7e60a8a54c80>	Operating System
schneider-electric	modicon_m340_bmxnoe0100_firmware	-	<built-in method update of dict object at 0x7e60ba2a6e80>	Operating System
schneider-electric	modicon_m340_bmxnoe0110_firmware	-	<built-in method update of dict object at 0x7e60e832e840>	Operating System
schneider-electric	modicon_m340_bmxnoe0110h_firmware	-	<built-in method update of dict object at 0x7e60e832ee00>	Operating System
schneider-electric	modicon_m340_bmxnor0200h_firmware	-	<built-in method update of dict object at 0x7e60eb2ac2c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp341000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342010_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342010:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420102_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0100_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0110_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0110:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0110h_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0110h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxnor0200h_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxnor0200h:-:::::::*`

References

https://www.se.com/us/en/download/document/SEVD-2022-102-02/
Source: [email protected]

Vendor Advisory
https://www.se.com/us/en/download/document/SEVD-2022-102-02/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory