CVE-2022-45788: schneider electric ecostruxure control expert

Vulnerability summary

CVE-2022-45788 is a critical (CVSS 9.8) vulnerability in schneider electric ecostruxure control expert. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 66.9% of scored vulnerabilities.

Timeline

1. 30-01-2023
   PublishedVulnerability first disclosed.
2. 29-05-2026
   Last modifiedVulnerability information updated.

Description

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions), Modicon Momentum Unity M1E Processor - 171CBU* (All Versions), Modicon MC80 - BMKC80 (All Versions), Legacy Modicon Quantum - 140CPU65* and Premium CPUs - TSXP57* (All Versions)

• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.