CVE-2021-22791

Published on: 09/02/2021 12:00:00 AM UTC

Last Modified on: 09/13/2021 07:28:00 PM UTC

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Certain versions of Modicon M340 Bmxp341000 from Schneider-electric contain the following vulnerability:

A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).

  • CVE-2021-22791 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as MEDIUM severity.

CVSS3 Score: 6.5 - MEDIUM

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK LOW LOW NONE
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED NONE NONE HIGH

CVSS2 Score: 4 - MEDIUM

Access
Vector
Access
Complexity
Authentication
NETWORK LOW SINGLE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
NONE NONE PARTIAL

CVE References

Description Tags Link
download.schneider-electric.com
application/pdf
URL Logo MISC download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-06
Patch
Vendor Advisory
download.schneider-electric.com
application/pdf
URL Logo MISC download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
HardwareSchneider-electricModicon M340 Bmxp341000-AllAllAll
HardwareSchneider-electricModicon M340 Bmxp342010-AllAllAll
HardwareSchneider-electricModicon M340 Bmxp342020-AllAllAll
HardwareSchneider-electricModicon M340 Bmxp342030-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh582040-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh582040c-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh582040s-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh584040-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh584040c-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh584040s-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh586040-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh586040c-AllAllAll
HardwareSchneider-electricModicon M580 Bmeh586040s-AllAllAll
HardwareSchneider-electricModicon M580 Bmep581020-AllAllAll
HardwareSchneider-electricModicon M580 Bmep581020h-AllAllAll
HardwareSchneider-electricModicon M580 Bmep582020-AllAllAll
HardwareSchneider-electricModicon M580 Bmep582020h-AllAllAll
HardwareSchneider-electricModicon M580 Bmep582040-AllAllAll
HardwareSchneider-electricModicon M580 Bmep582040h-AllAllAll
HardwareSchneider-electricModicon M580 Bmep582040s-AllAllAll
HardwareSchneider-electricModicon M580 Bmep583020-AllAllAll
HardwareSchneider-electricModicon M580 Bmep583040-AllAllAll
HardwareSchneider-electricModicon M580 Bmep584020-AllAllAll
HardwareSchneider-electricModicon M580 Bmep584040-AllAllAll
HardwareSchneider-electricModicon M580 Bmep584040s-AllAllAll
HardwareSchneider-electricModicon M580 Bmep585040-AllAllAll
HardwareSchneider-electricModicon M580 Bmep585040c-AllAllAll
HardwareSchneider-electricModicon M580 Bmep586040-AllAllAll
HardwareSchneider-electricModicon M580 Bmep586040c-AllAllAll
HardwareSchneider-electricModicon Mc80 Bmkc8020301-AllAllAll
HardwareSchneider-electricModicon Mc80 Bmkc8020310-AllAllAll
HardwareSchneider-electricModicon Mc80 Bmkc8030311-AllAllAll
HardwareSchneider-electricModicon Momentum 171cbu78090-AllAllAll
HardwareSchneider-electricModicon Momentum 171cbu98090-AllAllAll
HardwareSchneider-electricModicon Momentum 171cbu98091-AllAllAll
HardwareSchneider-electricModicon Premium Tsxp57 1634m-AllAllAll
HardwareSchneider-electricModicon Premium Tsxp57 2634m-AllAllAll
HardwareSchneider-electricModicon Premium Tsxp57 2834m-AllAllAll
HardwareSchneider-electricModicon Premium Tsxp57 454m-AllAllAll
HardwareSchneider-electricModicon Premium Tsxp57 4634m-AllAllAll
HardwareSchneider-electricModicon Premium Tsxp57 554m-AllAllAll
HardwareSchneider-electricModicon Premium Tsxp57 5634m-AllAllAll
HardwareSchneider-electricModicon Premium Tsxp57 6634m-AllAllAll
HardwareSchneider-electricModicon Quantum 140cpu65150-AllAllAll
HardwareSchneider-electricModicon Quantum 140cpu65150c-AllAllAll
HardwareSchneider-electricModicon Quantum 140cpu65160-AllAllAll
HardwareSchneider-electricModicon Quantum 140cpu65160c-AllAllAll
HardwareSchneider-electricPlc Simulator For Ecostruxure Control Expert-AllAllAll
HardwareSchneider-electricPlc Simulator For Ecostruxure Process Expert-AllAllAll
  • cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m340_bmxp342010:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040c:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh582040s:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040c:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh584040s:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040c:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmeh586040s:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_mc80_bmkc8020301:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_mc80_bmkc8020310:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_mc80_bmkc8030311:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_momentum_171cbu78090:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_momentum_171cbu98090:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_momentum_171cbu98091:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_premium_tsxp57_1634m:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_premium_tsxp57_2634m:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_premium_tsxp57_2834m:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_premium_tsxp57_454m:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_premium_tsxp57_4634m:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_premium_tsxp57_554m:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_premium_tsxp57_5634m:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_premium_tsxp57_6634m:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65150:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65150c:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65160:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65160c:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:plc_simulator_for_ecostruxure_control_expert:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:schneider-electric:plc_simulator_for_ecostruxure_process_expert:-:*:*:*:*:*:*:*:

Social Mentions

Source Title Posted (UTC)
Twitter Icon @CVEreport CVE-2021-22791 : A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon P… twitter.com/i/web/status/1… 2021-09-02 17:07:35
Twitter Icon @threatmeter CVE-2021-22791 A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC… twitter.com/i/web/status/1… 2021-09-03 07:09:42
© CVE.report 2021 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report