CVE-2022-45789 CRITICAL

Published: 2023-01-31 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)

Additional Descriptions (1)

Existe una vulnerabilidad CWE-294: Omisión de autenticación mediante captura-reproducción que podría provocar la ejecución de funciones Modbus no autorizadas en el controlador al secuestrar una sesión Modbus autenticada. Productos afectados: EcoStruxure Control Expert (todas las versiones), EcoStruxure Process Expert (todas las versiones), CPU Modicon M340 - números de pieza BMXP34* (todas las versiones), CPU Modicon M580 - números de pieza BMEP* y BMEH* (todas las versiones), Modicon M580 Seguridad de la CPU: números de pieza BMEP58*S y BMEH58*S (todas las versiones)

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-294

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	ecostruxure_control_expert	*	<built-in method update of dict object at 0x7e60a8895d00>	Application
schneider-electric	ecostruxure_process_expert	*	<built-in method update of dict object at 0x7e60bafad000>	Application
schneider-electric	modicon_m340_bmxp341000_firmware	*	<built-in method update of dict object at 0x7e60bacd5ec0>	Operating System
schneider-electric	modicon_m340_bmxp342000_firmware	*	<built-in method update of dict object at 0x7e60a88944c0>	Operating System
schneider-electric	modicon_m340_bmxp342010_firmware	-	<built-in method update of dict object at 0x7e60a8896000>	Operating System
schneider-electric	modicon_m340_bmxp3420102_firmware	*	<built-in method update of dict object at 0x7e60a8895880>	Operating System
schneider-electric	modicon_m340_bmxp342020_firmware	*	<built-in method update of dict object at 0x7e60bacd5c00>	Operating System
schneider-electric	modicon_m340_bmxp342020h_firmware	*	<built-in method update of dict object at 0x7e61109d6380>	Operating System
schneider-electric	modicon_m340_bmxp342030_firmware	*	<built-in method update of dict object at 0x7e60bacd4300>	Operating System
schneider-electric	modicon_m340_bmxp3420302_firmware	*	<built-in method update of dict object at 0x7e60a8897580>	Operating System
schneider-electric	modicon_m340_bmxp3420302h_firmware	*	<built-in method update of dict object at 0x7e61109d6140>	Operating System
schneider-electric	modicon_m340_bmxp342030h_firmware	*	<built-in method update of dict object at 0x7e60a8896240>	Operating System
schneider-electric	modicon_m580_bmep581020_firmware	*	<built-in method update of dict object at 0x7e60bacd6540>	Operating System
schneider-electric	modicon_m580_bmep581020h_firmware	*	<built-in method update of dict object at 0x7e61109d4dc0>	Operating System
schneider-electric	modicon_m580_bmep582020_firmware	*	<built-in method update of dict object at 0x7e6112392f00>	Operating System
schneider-electric	modicon_m580_bmep582020h_firmware	*	<built-in method update of dict object at 0x7e60bacd4cc0>	Operating System
schneider-electric	modicon_m580_bmep582040_firmware	*	<built-in method update of dict object at 0x7e60bae48c80>	Operating System
schneider-electric	modicon_m580_bmep582040h_firmware	*	<built-in method update of dict object at 0x7e60bacd7200>	Operating System
schneider-electric	modicon_m580_bmep582040s_firmware	*	<built-in method update of dict object at 0x7e61109d6180>	Operating System
schneider-electric	modicon_m580_bmep583020_firmware	*	<built-in method update of dict object at 0x7e60bafac040>	Operating System
schneider-electric	modicon_m580_bmep583040_firmware	*	<built-in method update of dict object at 0x7e61109d4740>	Operating System
schneider-electric	modicon_m580_bmep584020_firmware	*	<built-in method update of dict object at 0x7e60bafac1c0>	Operating System
schneider-electric	modicon_m580_bmep584040_firmware	*	<built-in method update of dict object at 0x7e61109d5d40>	Operating System
schneider-electric	modicon_m580_bmep584040s_firmware	*	<built-in method update of dict object at 0x7e61109d7f00>	Operating System
schneider-electric	modicon_m580_bmep585040_firmware	*	<built-in method update of dict object at 0x7e60bafafac0>	Operating System
schneider-electric	modicon_m580_bmep585040c_firmware	*	<built-in method update of dict object at 0x7e60bacd53c0>	Operating System
schneider-electric	modicon_m580_bmep586040_firmware	*	<built-in method update of dict object at 0x7e60a8897e40>	Operating System
schneider-electric	modicon_m580_bmep586040c_firmware	*	<built-in method update of dict object at 0x7e60bacd68c0>	Operating System
schneider-electric	modicon_m580_bmeh582040_firmware	*	<built-in method update of dict object at 0x7e61109d7a80>	Operating System
schneider-electric	modicon_m580_bmeh582040c_firmware	*	<built-in method update of dict object at 0x7e60bae4ad80>	Operating System
schneider-electric	modicon_m580_bmeh582040s_firmware	*	<built-in method update of dict object at 0x7e61109d4780>	Operating System
schneider-electric	modicon_m580_bmeh584040_firmware	*	<built-in method update of dict object at 0x7e6112393880>	Operating System
schneider-electric	modicon_m580_bmeh584040c_firmware	*	<built-in method update of dict object at 0x7e60bacd7340>	Operating System
schneider-electric	modicon_m580_bmeh584040s_firmware	*	<built-in method update of dict object at 0x7e60bacd5600>	Operating System
schneider-electric	modicon_m580_bmeh586040_firmware	*	<built-in method update of dict object at 0x7e60bacd71c0>	Operating System
schneider-electric	modicon_m580_bmeh586040c_firmware	*	<built-in method update of dict object at 0x7e6112392e00>	Operating System
schneider-electric	modicon_m580_bmeh586040s_firmware	*	<built-in method update of dict object at 0x7e60bacd7740>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_control_expert::::::::`
Yes	`cpe:2.3:a:schneider-electric:ecostruxure_process_expert::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp341000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342010_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342010::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420102_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep581020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep581020h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582020h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep582040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep583020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep583040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584020_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep584040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep585040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep585040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep586040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmep586040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh582040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh584040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_bmeh586040s_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040s:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf
Source: [email protected]

Patch Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Patch Vendor Advisory