CVE-2022-0222
High
Description
A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24)
SeverityHigh
CVSS7.5
Exploit probability—
ProductSchneider-electric Modicon M340 Bmxp341000 Firmware
PublishedNov 22, 2022
First seenNov 22, 2022
Weakness typeCWE-269Improper privilege management
How to fix
Update
- schneider-electric modicon_m340_bmxp341000_firmware3.50 or later
- schneider-electric modicon_m340_bmxp342000_firmware3.50 or later
- schneider-electric modicon_m340_bmxp342010_firmware3.50 or later
- schneider-electric modicon_m340_bmxp3420102_firmware3.50 or later
- schneider-electric modicon_m340_bmxp342020_firmware3.50 or later
- schneider-electric modicon_m340_bmxp342020h_firmware3.50 or later
- schneider-electric modicon_m340_bmxp342030_firmware3.50 or later
- schneider-electric modicon_m340_bmxp3420302_firmware3.50 or later
- schneider-electric modicon_m340_bmxp3420302h_firmware3.50 or later
- schneider-electric modicon_m340_bmxp342030h_firmware3.50 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric modicon_m340_bmxp341000_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp342000_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp342010_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp3420102_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp342020_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp342020h_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp342030_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp3420302_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp3420302h_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxp342030h_firmware | v < 3.50 | 3.50 |
| schneider-electric modicon_m340_bmxnoe0100_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxnoe0110_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxnoe0110h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxnor0200h_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.