Lucene search

K
nvd[email protected]NVD:CVE-2021-22787
HistoryFeb 11, 2022 - 6:15 p.m.

CVE-2021-22787

2022-02-1118:15:09
CWE-20
web.nvd.nist.gov

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

33.4%

A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)

Affected configurations

NVD
Node
schneider-electricmodicon_m340_bmxp342020_firmwareRange<3.40
AND
schneider-electricmodicon_m340_bmxp342020Match-
Node
schneider-electricbmxnoe0100_firmware
AND
schneider-electricbmxnoe0100Match-
Node
schneider-electricbmxnoe0110_firmware
AND
schneider-electricbmxnoe0110Match-
Node
schneider-electricbmxnoc0401_firmware
AND
schneider-electricbmxnoc0401Match-
Node
schneider-electricbmxnor0200h_rtu_firmware
AND
schneider-electricbmxnor0200h_rtuMatch-
Node
schneider-electrictsxp574634_firmware
AND
schneider-electrictsxp574634Match-
Node
schneider-electrictsxp575634_firmware
AND
schneider-electrictsxp575634Match-
Node
schneider-electrictsxp576634_firmware
AND
schneider-electrictsxp576634Match-
Node
schneider-electric140cpu65150_firmware
AND
schneider-electric140cpu65150Match-
Node
schneider-electric140noe771x1_firmware
AND
schneider-electric140noe771x1Match-
Node
schneider-electric140noc78x00_firmware
AND
schneider-electric140noc78x00Match-
Node
schneider-electric140noc77101_firmware
AND
schneider-electric140noc77101Match-
Node
schneider-electrictsxety4103_firmware
AND
schneider-electrictsxety4103Match-
Node
schneider-electrictsxety5103_firmware
AND
schneider-electrictsxety5103Match-

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

33.4%

Related for NVD:CVE-2021-22787