CVE-2021-22787

Published: Feb 11, 2022Modified: May 29, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)

Affected (14)

Products: Schneider Electric: Modicon M340 Bmxp342020 Firmware, Bmxnoe0100 Firmware, Bmxnoe0110 Firmware, Bmxnoc0401 Firmware, Bmxnor0200h Rtu Firmware, Tsxp574634 Firmware, Tsxp575634 Firmware, Tsxp576634 Firmware, 140cpu65150 Firmware, 140noe771x1 Firmware, 140noc78x00 Firmware, 140noc77101 Firmware, Tsxety4103 Firmware, Tsxety5103 Firmware

Schneider Electric

14 products

Modicon M340 Bmxp342020 Firmware

Bmxnoe0100 Firmware

Bmxnoe0110 Firmware

Bmxnoc0401 Firmware

Bmxnor0200h Rtu Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342020 Firmware	Before 3.40

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342020	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoe0100 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Bmxnoe0100	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoe0110 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Bmxnoe0110	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoc0401 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Bmxnoc0401	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnor0200h Rtu Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Bmxnor0200h Rtu	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp574634 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Tsxp574634	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp575634 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Tsxp575634	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp576634 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Tsxp576634	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140cpu65150 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric 140cpu65150	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noe771x1 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric 140noe771x1	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noc78x00 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric 140noc78x00	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noc77101 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric 140noc77101	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxety4103 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Tsxety4103	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxety5103 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Tsxety5103	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02

Source: cybersecurity@se.com

PatchVendor Advisory

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.