ICSA-23-201-01

icsaUScisa_csaf_ot

Schneider Electric EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers

Advisory ansehen veröffentlicht 2023-07-20

Successful exploitation of these vulnerabilities could allow an attacker unauthorized access to components, ability to execute arbitrary code, or ability to execute a denial-of-service.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2022-45788UScritical9.8—
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & inte…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (14)

  • MitigationEcoStruxure Control Expert

    Schneider Electric has released the following remediations for users to implement:

  • MitigationEcoStruxure Process Expert

    Schneider Electric has released the following remediations for users to implement:

  • MitigationLegacy Modicon Quantum (part numbers 140CPU65*) and Premium CPUs (part numbers TSXP57*)

    Schneider Electric has released the following remediations for users to implement:

  • MitigationModicon M340 CPU (part numbers BMXP34*)

    Schneider Electric has released the following remediations for users to implement:

  • MitigationModicon M580 CPU (part numbers BMEP* and BMEH*)

    Schneider Electric has released the following remediations for users to implement:

  • MitigationModicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)

    Schneider Electric has released the following remediations for users to implement:

  • MitigationModicon MC80 CPU (part numbers BMKC80*)

    Schneider Electric has released the following remediations for users to implement:

  • MitigationModicon Momentum Unity M1E Processor (part numbers 171CBU*)

    Schneider Electric has released the following remediations for users to implement:

  • BehobenEcoStruxure Control Expert

    EcoStruxure Control Expert: Software V15.3 includes a fix for this vulnerability and is available for download.

    https://www.se.com/ww/en/download/document/EcoStruxureControlExpert-V15.3/
  • BehobenEcoStruxure Process Expert

    EcoStruxure Process Expert: Version V2021 available for download and is not impacted by this vulnerability as the affected component has been removed from this version.

    https://www.se.com/ww/en/product-range/65406-ecostruxure-process-expert/#software-and-firmware
  • BehobenModicon M340 CPU (part numbers BMXP34*)

    Modicon M340 CPU (part numbers BMXP34*): Firmware SV3.51 includes a fix for this vulnerability and is available for download.

    https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware
  • BehobenModicon M580 CPU (part numbers BMEP* and BMEH*)

    Modicon M580 CPU (part numbers BMEP* and BMEH*): Firmware SV4.10 includes a fix for this vulnerability and is available for download.

    https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/
  • BehobenModicon MC80 CPU (part numbers BMKC80*)

    Modicon MC80 CPU (part numbers BMKC80*): Firmware SV1.90 includes a fix for this vulnerability and is available for download.

    https://www.se.com/ww/en/download/document/BMKC80_Firmware_upgrade/
  • BehobenModicon Momentum Unity M1E Processor (part numbers 171CBU*)

    Modicon Momentum Unity M1E Processor (part numbers 171CBU*): Firmware VS2.6 includes a fix for this vulnerability and is available for download.

    https://www.se.com/ww/en/download/document/Momentum_FW_update/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan