Vulnerability · Published Jan 31, 2023 · Assigned by schneider
CVE-2022-45789
High 8.1
In plain English
A high-severity security flaw in EcoStruxure Control Expert from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | EcoStruxure Control Expert | All Versions |
| Schneider Electric | EcoStruxure Process Expert | All Versions |
| Schneider Electric | Modicon M340 CPU (part numbers BMXP34*) | All Versions |
| Schneider Electric | Modicon M580 CPU (part numbers BMEP* and BMEH*) | All Versions |
| Schneider Electric | Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) | All Versions |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H