CVE-2021-22786: schneider electric legacy modicon quantum
Vulnerability summary
CVE-2021-22786 is a high (CVSS 7.5) vulnerability in schneider electric legacy modicon quantum. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.1% of scored vulnerabilities.
Timeline
- 01-02-2023PublishedVulnerability first disclosed.
- 05-02-2025Last modifiedVulnerability information updated.
Description
A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communicating over the Modbus TCP protocol. Affected Products: Modicon M340 CPU (part numbers BMXP34*) (Versions prior to V3.30), Modicon M580 CPU (part numbers BMEP* and BMEH*) (Versions prior to SV3.20), Modicon MC80 (BMKC80) (Versions prior to V1.6), Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) (All Versions), Modicon Momentum MDI (171CBU*) (Versions prior to V2.3), Legacy Modicon Quantum (All Versions)
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.63% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Schneider-electric41 products
- modicon_m340_bmxp341000_firmware< 3.40
- modicon_m340_bmxp342000_firmware< 3.40
- modicon_m340_bmxp342010_firmware< 3.40
- modicon_m340_bmxp3420102_firmware< 3.40
- modicon_m340_bmxp342020_firmware< 3.40
Schneider electric6 products
- legacy modicon quantumAll versions (No fix recorded)
- modicon m340 cpu (part numbers bmxp34*)≥ All, < V3.30
- modicon m580 cpu (part numbers bmep* and bmeh*)≥ All, < V3.20
- modicon m580 cpu safety (part numbers bmep58*s and bmeh58*s)All versions (No fix recorded)
- modicon mc80 (bmkc80)≥ All, < V1.6
2 vendors · 47 products