Log in Start free

Vulnerability · Published Apr 19, 2023 · Assigned by schneider

CVE-2023-25620

Medium 6.5

In plain English

A medium-severity security flaw in Legacy Modicon Premium CPUs (TSXP57*) from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.6%top 51.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when a malicious project file is loaded onto the controller by an authenticated user.

Affected products (as reported)

VendorProductVersions
Schneider Electric Modicon M340 CPU (part numbers BMXP34*) prior to SV3.51
Schneider Electric Modicon M580 CPU (part numbers BMEP* and BMEH*) prior to V4.10
Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) All
Schneider Electric Modicon Momentum Unity M1E Processor (171CBU*) All
Schneider Electric Modicon MC80 (BMKC80) All
Schneider Electric Legacy Modicon Quantum (140CPU65*) All
Schneider Electric Legacy Modicon Premium CPUs (TSXP57*) All

Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References