CVE-2022-45789: schneider electric ecostruxure control expert Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2022-45789 is a critical (CVSS 9.8) Authentication Bypass by Capture-replay vulnerability in schneider electric ecostruxure control expert. EPSS estimates a 1.46% chance of exploitation in the next 30 days, higher than 73% of scored vulnerabilities.

Timeline

1. 31-01-2023
   PublishedVulnerability first disclosed.
2. 29-05-2026
   Last modifiedVulnerability information updated.

Description

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).