CVE-2021-22787

High

Description

A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)

SeverityHigh
CVSS7.5
Exploit probability65. percentile1.1%
ProductSchneider-electric Modicon M340 Bmxp342020 Firmware
PublishedFeb 11, 2022
First seenFeb 11, 2022

How to fix

Update
  • schneider-electric modicon_m340_bmxp342020_firmware3.40 or later

Affected products

ProductAffected versionsFixed in
schneider-electric modicon_m340_bmxp342020_firmwarev < 3.403.40
schneider-electric bmxnoe0100_firmwareNo range specified—
schneider-electric bmxnoe0110_firmwareNo range specified—
schneider-electric bmxnoc0401_firmwareNo range specified—
schneider-electric bmxnor0200h_rtu_firmwareNo range specified—
schneider-electric tsxp574634_firmwareNo range specified—
schneider-electric tsxp575634_firmwareNo range specified—
schneider-electric tsxp576634_firmwareNo range specified—
schneider-electric 140cpu65150_firmwareNo range specified—
schneider-electric 140noe771x1_firmwareNo range specified—
schneider-electric 140noc78x00_firmwareNo range specified—
schneider-electric 140noc77101_firmwareNo range specified—
schneider-electric tsxety4103_firmwareNo range specified—
schneider-electric tsxety5103_firmwareNo range specified—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.