Vulnerability · Published Feb 1, 2023 · Assigned by schneider
CVE-2021-22786
High 7.5
In plain English
A high-severity information exposure in Legacy Modicon Quantum from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communicating over the Modbus TCP protocol. Affected Products: Modicon M340 CPU (part numbers BMXP34*) (Versions prior to V3.30), Modicon M580 CPU (part numbers BMEP* and BMEH*) (Versions prior to SV3.20), Modicon MC80 (BMKC80) (Versions prior to V1.6), Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) (All Versions), Modicon Momentum MDI (171CBU*) (Versions prior to V2.3), Legacy Modicon Quantum (All Versions)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Modicon M340 CPU (part numbers BMXP34*) | All – before V3.30 |
| Schneider Electric | Modicon M580 CPU (part numbers BMEP* and BMEH*) | All – before V3.20 |
| Schneider Electric | Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) | All Versions |
| Schneider Electric | Modicon MC80 (BMKC80) | All – before V1.6 |
| Schneider Electric | Modicon Momentum CPU (171CBU*) | All – before V2.3 |
| Schneider Electric | Legacy Modicon Quantum | All Versions |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N