Vulnerability · Published Nov 22, 2022 · Assigned by schneider
CVE-2022-37301
High 7.5
In plain English
A high-severity security flaw in Legacy Modicon Quantum/Premium from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Official description
A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34*)(V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*)(V3.22 and prior), Legacy Modicon Quantum/Premium(All Versions), Modicon Momentum MDI (171CBU*)(All Versions), Modicon MC80 (BMKC80)(V1.7 and prior)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Modicon M340 CPU (part numbers BMXP34*) | V – through 3.40 |
| Schneider Electric | Modicon M580 CPU (part numbers BMEP* and BMEH*) | V – through 3.22 |
| Schneider Electric | Legacy Modicon Quantum/Premium | All Versions |
| Schneider Electric | Modicon Momentum MDI (171CBU*) | All Versions |
| Schneider Electric | Modicon MC80 (BMKC80) | V – through 1.7 |
Weakness: CWE-191 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H