CVE-2021-22787
Description
A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)
How to fix
- schneider-electric modicon_m340_bmxp342020_firmware3.40 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric modicon_m340_bmxp342020_firmware | v < 3.40 | 3.40 |
| schneider-electric bmxnoe0100_firmware | No range specified | — |
| schneider-electric bmxnoe0110_firmware | No range specified | — |
| schneider-electric bmxnoc0401_firmware | No range specified | — |
| schneider-electric bmxnor0200h_rtu_firmware | No range specified | — |
| schneider-electric tsxp574634_firmware | No range specified | — |
| schneider-electric tsxp575634_firmware | No range specified | — |
| schneider-electric tsxp576634_firmware | No range specified | — |
| schneider-electric 140cpu65150_firmware | No range specified | — |
| schneider-electric 140noe771x1_firmware | No range specified | — |
| schneider-electric 140noc78x00_firmware | No range specified | — |
| schneider-electric 140noc77101_firmware | No range specified | — |
| schneider-electric tsxety4103_firmware | No range specified | — |
| schneider-electric tsxety5103_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.