Schneider Electric EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers
Successful exploitation of these vulnerabilities could allow an attacker unauthorized access to components, ability to execute arbitrary code, or ability to execute a denial-of-service.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-45788US | critical9.8 | — | ||
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & inte… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-23-201-01 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-23-201-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (14)
- MitigationEcoStruxure Control Expert
Schneider Electric has released the following remediations for users to implement:
- MitigationEcoStruxure Process Expert
Schneider Electric has released the following remediations for users to implement:
- MitigationLegacy Modicon Quantum (part numbers 140CPU65*) and Premium CPUs (part numbers TSXP57*)
Schneider Electric has released the following remediations for users to implement:
- MitigationModicon M340 CPU (part numbers BMXP34*)
Schneider Electric has released the following remediations for users to implement:
- MitigationModicon M580 CPU (part numbers BMEP* and BMEH*)
Schneider Electric has released the following remediations for users to implement:
- MitigationModicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)
Schneider Electric has released the following remediations for users to implement:
- MitigationModicon MC80 CPU (part numbers BMKC80*)
Schneider Electric has released the following remediations for users to implement:
- MitigationModicon Momentum Unity M1E Processor (part numbers 171CBU*)
Schneider Electric has released the following remediations for users to implement:
- FixedEcoStruxure Control Expert
EcoStruxure Control Expert: Software V15.3 includes a fix for this vulnerability and is available for download.
https://www.se.com/ww/en/download/document/EcoStruxureControlExpert-V15.3/ - FixedEcoStruxure Process Expert
EcoStruxure Process Expert: Version V2021 available for download and is not impacted by this vulnerability as the affected component has been removed from this version.
https://www.se.com/ww/en/product-range/65406-ecostruxure-process-expert/#software-and-firmware - FixedModicon M340 CPU (part numbers BMXP34*)
Modicon M340 CPU (part numbers BMXP34*): Firmware SV3.51 includes a fix for this vulnerability and is available for download.
https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware - FixedModicon M580 CPU (part numbers BMEP* and BMEH*)
Modicon M580 CPU (part numbers BMEP* and BMEH*): Firmware SV4.10 includes a fix for this vulnerability and is available for download.
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/ - FixedModicon MC80 CPU (part numbers BMKC80*)
Modicon MC80 CPU (part numbers BMKC80*): Firmware SV1.90 includes a fix for this vulnerability and is available for download.
https://www.se.com/ww/en/download/document/BMKC80_Firmware_upgrade/ - FixedModicon Momentum Unity M1E Processor (part numbers 171CBU*)
Modicon Momentum Unity M1E Processor (part numbers 171CBU*): Firmware VS2.6 includes a fix for this vulnerability and is available for download.
https://www.se.com/ww/en/download/document/Momentum_FW_update/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan