CVE-2021-22787: schneider-electric modicon_m340_bmxp342020_firmware Improper Input Validation

Vulnerability summary

CVE-2021-22787 is a high (CVSS 7.5) Improper Input Validation vulnerability in schneider-electric modicon_m340_bmxp342020_firmware. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.5% of scored vulnerabilities.

Timeline

1. 11-02-2022
   PublishedVulnerability first disclosed.
2. 29-05-2026
   Last modifiedVulnerability information updated.

Description

A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.