// Description
Schneider Electric Security Notification
11-May-21 Document Reference Number – SEVD-2021-130-05 Page 1 of 5
## Modicon M241 & M251 Logic Controllers
11 May 2021
## Overview
Schneider Electric is aware of a vulnerability in its Modicon M241/M251 logic controllers.
The Modicon M241 and M251 are Programmable Logic Controllers for performance-demanding applications.
Failure to apply the remediations provided below may risk a buffer overflow attack, which could result in the unavailability of the controller.
## Affected Products and Versions
Modicon M241/M251 logic controllers firmware prior to V5.1.9.1
## Vulnerability Details
CVE ID: CVE-2021-22699
CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service when specific crafted requests are sent to the controller over HTTP.
## Remediation
A fix for this vulnerability is available by following the steps below:
1. Update Software -
On the engineering workstation, update to EcoStruxure Machine Expert V2.0 or above:
https://www.se.com/ww/en/product-range-download/2226-ecostruxure-machine-expert-%28somachine%29/?selected-node-id=14435955187#/software-firmware-tab
2. Update Firmware -
On Modicon M241/M251 Logic Controllers, update to firmware version V5.1.9.14 or higher available within EcoStruxure Machine Expert V2.0. A reboot is needed.
Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: