Details of VAR-202209-0597

ID

VAR-202209-0597

CVE

CVE-2022-37300

TITLE

Multiple Schneider Electric Product Authorization Issue Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202209-725

DESCRIPTION

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).

Trust: 1.0

sources: NVD: CVE-2022-37300

AFFECTED PRODUCTS

vendor:	schneider electric	model:	modicon m580 bmep582020	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420302	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep585040c	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep581020h	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342000	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep584020	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh582040s	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep583020	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep582040h	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep584040s	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342020h	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh582040c	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep581020	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep582040	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh584040	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420102	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh584040c	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep582020h	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep586040	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342030	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep586040c	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	ecostruxure process expert	scope:	lte	version:	2021	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342020	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh584040s	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh586040	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep584040	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep585040	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmep583040	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh586040s	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	ecostruxure control expert	scope:	lt	version:	15.1	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420302h	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh582040	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m580 bmeh586040c	scope:	lt	version:	4.02	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342010	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342030h	scope:	lt	version:	3.50	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp341000	scope:	lt	version:	3.50	Trust: 1.0

sources: NVD: CVE-2022-37300

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-37300
value:	CRITICAL
Trust: 1.0
CNNVD:	CNNVD-202209-725
value:	CRITICAL
Trust: 0.6

NVD:	CVE-2022-37300
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNNVD: CNNVD-202209-725 // NVD: CVE-2022-37300

PROBLEMTYPE DATA

problemtype:

CWE-640

Trust: 1.0

sources: NVD: CVE-2022-37300

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202209-725

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202209-725

CONFIGURATIONS

sources: NVD: CVE-2022-37300

PATCH

title:

Multiple Schneider Electric Product Authorization Issue Vulnerability Fixing Measures

url:

http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=207862

Trust: 0.6

sources: CNNVD: CNNVD-202209-725

EXTERNAL IDS

db:	NVD	id:	CVE-2022-37300	Trust: 1.6
db:	SCHNEIDER	id:	SEVD-2022-221-01	Trust: 1.6
db:	CNNVD	id:	CNNVD-202209-725	Trust: 0.6

sources: CNNVD: CNNVD-202209-725 // NVD: CVE-2022-37300

REFERENCES

url:	https://www.se.com/us/en/download/document/sevd-2022-221-01/	Trust: 1.6
url:	https://cxsecurity.com/cveshow/cve-2022-37300/	Trust: 0.6

sources: CNNVD: CNNVD-202209-725 // NVD: CVE-2022-37300

SOURCES

db:	CNNVD	id:	CNNVD-202209-725
db:	NVD	id:	CVE-2022-37300

LAST UPDATE DATE

2022-09-16T22:28:54.978000+00:00

SOURCES UPDATE DATE

db:	CNNVD	id:	CNNVD-202209-725	date:	2022-09-16T00:00:00
db:	NVD	id:	CVE-2022-37300	date:	2022-09-15T17:30:00

SOURCES RELEASE DATE

db:	CNNVD	id:	CNNVD-202209-725	date:	2022-09-12T00:00:00
db:	NVD	id:	CVE-2022-37300	date:	2022-09-12T18:15:00