NetSight
IP …
high8.1

CVE-2022-45789

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hija…

Impact

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)

Affected products

VendorProductAffected versions
Schneider-ElectricEcostruxure Control Expert
All versions
Schneider-ElectricEcostruxure Process Expert
through 2020
Schneider-ElectricModicon M340 Bmxp341000 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342000 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342010 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp3420102 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342020 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342020h Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342030 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp3420302 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp3420302h Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342030h Firmware
All versions

Weakness classification

CWE-294

References