Sign-up

ID

VAR-202202-1168


CVE

CVE-2021-22785


TITLE

plural  Schneider Electric  Vulnerability regarding information leakage in products

Trust: 0.8

sources: JVNDB: JVNDB-2021-018470

DESCRIPTION

A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker sends a HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions). plural Schneider Electric The product contains an information disclosure vulnerability.Information may be obtained. Schneider Electric Modicon Quantum, etc. are products of the French Schneider Electric (Schneider Electric). The Schneider Electric Modicon Quantum is a large programmable logic controller (PLC) for process applications, high availability and safety solutions. The Schneider Electric Modicon M340 is a mid-range PLC (Programmable Logic Controller) for industrial processes and infrastructure. Schneider Electric Modicon Premium is a programmable controller for industrial environments

Trust: 2.25

sources: NVD: CVE-2021-22785 // JVNDB: JVNDB-2021-018470 // CNVD: CNVD-2022-68925 // VULMON: CVE-2021-22785

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-68925

AFFECTED PRODUCTS

vendor:schneider electricmodel:140noc78x00scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342020scope:ltversion:3.40

Trust: 1.0

vendor:schneider electricmodel:bmxnoe0100scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:bmxnoc0401scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:140noc77101scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:140cpu65150scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:tsxp576634scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:bmxnoe0110scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:bmxnor0200h rtuscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:140noe771x1scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:tsxety4103scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:tsxety5103scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:tsxp574634scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:tsxp575634scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:bmxnor0200h rtuscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoe0100scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoe0110scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:tsxp574634scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:tsxp575634scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoc0401scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:tsxp576634scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon quantum 140cpu65150scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp342020scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:140noe771x1scope: - version: -

Trust: 0.8

vendor:schneidermodel:electric modicon m340 cpus bmxp34scope:eqversion:(<=3.40)

Trust: 0.6

vendor:schneidermodel:electric modicon m340 ethernet communication modules bmxnoe0100scope:eqversion:x80

Trust: 0.6

vendor:schneidermodel:electric modicon m340 ethernet communication modules bmxnoe0110scope:eqversion:x80

Trust: 0.6

vendor:schneidermodel:electric modicon m340 ethernet communication modules bmxnoc0401scope:eqversion:x80

Trust: 0.6

vendor:schneidermodel:electric modicon m340 ethernet communication modules bmxnor0200h rtuscope:eqversion:x80

Trust: 0.6

vendor:schneidermodel:electric modicon premium processors with integrated ethernet tsxp574634scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon premium processors with integrated ethernet tsxp575634scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon premium processors with integrated ethernet tsxp576634scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon premium processors with integrated ethernet 140cpu65xxxxxscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon quantum communication modules 140noe771x1scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon quantum communication modules 140noc78x00scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon quantum communication modules 140noc77101scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon quantum communication modules tsxety4103scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon quantum communication modules tsxety5103scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2022-68925 // JVNDB: JVNDB-2021-018470 // NVD: CVE-2021-22785

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-22785
value: HIGH

Trust: 1.0

NVD: CVE-2021-22785
value: HIGH

Trust: 0.8

CNVD: CNVD-2022-68925
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202202-1043
value: HIGH

Trust: 0.6

VULMON: CVE-2021-22785
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-22785
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-68925
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-22785
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-22785
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-68925 // VULMON: CVE-2021-22785 // JVNDB: JVNDB-2021-018470 // CNNVD: CNNVD-202202-1043 // NVD: CVE-2021-22785

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.0

problemtype:information leak (CWE-200) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-018470 // NVD: CVE-2021-22785

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202202-1043

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202202-1043

PATCH

title:SEVD-2021-257-02url:https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02

Trust: 0.8

title:Patch for Multiple Schneider Electric Product Information Disclosure Vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/356586

Trust: 0.6

title:Schneider Electric Repair measures for information disclosure vulnerabilities of various productsurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=182742

Trust: 0.6

title: - url:https://github.com/Live-Hack-CVE/CVE-2021-22785

Trust: 0.1

sources: CNVD: CNVD-2022-68925 // VULMON: CVE-2021-22785 // JVNDB: JVNDB-2021-018470 // CNNVD: CNNVD-202202-1043

EXTERNAL IDS

db:NVDid:CVE-2021-22785

Trust: 3.9

db:SCHNEIDERid:SEVD-2021-257-02

Trust: 2.3

db:JVNDBid:JVNDB-2021-018470

Trust: 0.8

db:CNVDid:CNVD-2022-68925

Trust: 0.6

db:CNNVDid:CNNVD-202202-1043

Trust: 0.6

db:VULMONid:CVE-2021-22785

Trust: 0.1

sources: CNVD: CNVD-2022-68925 // VULMON: CVE-2021-22785 // JVNDB: JVNDB-2021-018470 // CNNVD: CNNVD-202202-1043 // NVD: CVE-2021-22785

REFERENCES

url:https://download.schneider-electric.com/files?p_doc_ref=sevd-2021-257-02

Trust: 2.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-22785

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/200.html

Trust: 0.1

url:https://github.com/live-hack-cve/cve-2021-22785

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2022-68925 // VULMON: CVE-2021-22785 // JVNDB: JVNDB-2021-018470 // CNNVD: CNNVD-202202-1043 // NVD: CVE-2021-22785

SOURCES

db:CNVDid:CNVD-2022-68925
db:VULMONid:CVE-2021-22785
db:JVNDBid:JVNDB-2021-018470
db:CNNVDid:CNNVD-202202-1043
db:NVDid:CVE-2021-22785

LAST UPDATE DATE

2024-08-14T14:37:39.948000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-68925date:2022-10-14T00:00:00
db:VULMONid:CVE-2021-22785date:2022-10-25T00:00:00
db:JVNDBid:JVNDB-2021-018470date:2023-06-15T07:46:00
db:CNNVDid:CNNVD-202202-1043date:2022-10-26T00:00:00
db:NVDid:CVE-2021-22785date:2024-04-10T12:28:45.957

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-68925date:2022-10-14T00:00:00
db:VULMONid:CVE-2021-22785date:2022-02-11T00:00:00
db:JVNDBid:JVNDB-2021-018470date:2023-06-15T00:00:00
db:CNNVDid:CNNVD-202202-1043date:2022-02-11T00:00:00
db:NVDid:CVE-2021-22785date:2022-02-11T18:15:08.947