CVE-2022-45789 — Schneider Electric / EcoStruxure Control Expert

Description (CNA)

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)

Affected (CNA)

Vendor / product	Versions
Schneider Electric / EcoStruxure Control Expert	affected All Versions
Schneider Electric / EcoStruxure Process Expert	affected All Versions
Schneider Electric / Modicon M340 CPU (part numbers BMXP34*)	affected All Versions
Schneider Electric / Modicon M580 CPU (part numbers BMEP* and BMEH*)	affected All Versions
Schneider Electric / Modicon M580 CPU Safety (part numbers BMEP58S and BMEH58S)	affected All Versions

CWE

CWE-294

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf

ADP enrichment

CVE

No English description supplied.

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf

CISA-ADP

No English description supplied.

No references supplied.