Sign-up

ID

VAR-202211-1344


CVE

CVE-2022-37301


TITLE

Schneider Electric Product Numeric Error Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2022-86330

DESCRIPTION

A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34*)(V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*)(V3.22 and prior), Legacy Modicon Quantum/Premium(All Versions), Modicon Momentum MDI (171CBU*)(All Versions), Modicon MC80 (BMKC80)(V1.7 and prior). Schneider Electric Modicon M340 is a medium-range PLC (programmable logic controller) for industrial processes and infrastructures from Schneider Electric, France. Schneider Electric products have a number error vulnerability. The vulnerability is caused by a memory access violation. Attackers can use the vulnerability to launch a denial of service attack

Trust: 1.53

sources: NVD: CVE-2022-37301 // CNVD: CNVD-2022-86330 // VULMON: CVE-2022-37301

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-86330

AFFECTED PRODUCTS

vendor:schneider electricmodel:modicon m340 bmx p34-2010scope:ltversion:3.50

Trust: 1.0

vendor:schneider electricmodel:modicon premium tsxp57 2634mscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep582040scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon premium tsxp57 1634mscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140cpu65160cscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep582020scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep584040sscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon mc80 bmkc8020310scope:ltversion:1.8

Trust: 1.0

vendor:schneider electricmodel:modicon momentum 171cbu78090scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon premium tsxp57 4634mscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep585040scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh584040sscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon premium tsxp57 554mscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep583020scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon premium tsxp57 6634mscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx p34-2030scope:ltversion:3.50

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep582040sscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140cpu65160scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep584040scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon premium tsxp57 2834mscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140noc78100scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh586040scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh582040cscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh584040cscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh582040sscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon premium tsxp57 5634mscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep586040scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh584040scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh586040sscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon premium tsxp57 454mscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep582020hscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon mc80 bmkc8030311scope:ltversion:1.8

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep586040cscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon momentum 171cbu98091scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140noe77101scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep584020scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon mc80 bmkc8020301scope:ltversion:1.8

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep582040hscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140cpu65150scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140noe77111scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh582040scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep581020scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep583040scope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh586040cscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep585040cscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep581020hscope:ltversion:4.01

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140cpu65150cscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon momentum 171cbu98090scope:eqversion: -

Trust: 1.0

vendor:schneidermodel:electric modicon momentum mdiscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon m340 cpuscope:lteversion:<=v3.40

Trust: 0.6

vendor:schneidermodel:electric modicon m580 cpuscope:lteversion:<=v3.22

Trust: 0.6

vendor:schneidermodel:electric modicon mc80scope:lteversion:<=v1.7

Trust: 0.6

vendor:schneidermodel:electric premiumscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric legacy modicon quantumscope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2022-86330 // NVD: CVE-2022-37301

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-37301
value: HIGH

Trust: 1.0

cybersecurity@se.com: CVE-2022-37301
value: HIGH

Trust: 1.0

CNVD: CNVD-2022-86330
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202211-3279
value: HIGH

Trust: 0.6

CNVD: CNVD-2022-86330
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-37301
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 2.0

sources: CNVD: CNVD-2022-86330 // CNNVD: CNNVD-202211-3279 // NVD: CVE-2022-37301 // NVD: CVE-2022-37301

PROBLEMTYPE DATA

problemtype:CWE-191

Trust: 1.0

sources: NVD: CVE-2022-37301

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202211-3279

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-202211-3279

PATCH

title:Patch for Schneider Electric Product Numeric Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/367081

Trust: 0.6

title:Schneider Electric Modicon M340 Fixes for digital error vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=215777

Trust: 0.6

sources: CNVD: CNVD-2022-86330 // CNNVD: CNNVD-202211-3279

EXTERNAL IDS

db:SCHNEIDERid:SEVD-2022-221-02

Trust: 2.3

db:NVDid:CVE-2022-37301

Trust: 2.3

db:CNVDid:CNVD-2022-86330

Trust: 0.6

db:CNNVDid:CNNVD-202211-3279

Trust: 0.6

db:VULMONid:CVE-2022-37301

Trust: 0.1

sources: CNVD: CNVD-2022-86330 // VULMON: CVE-2022-37301 // CNNVD: CNNVD-202211-3279 // NVD: CVE-2022-37301

REFERENCES

url:https://www.se.com/us/en/download/document/sevd-2022-221-02/

Trust: 2.3

url:https://cxsecurity.com/cveshow/cve-2022-37301/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/191.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2022-86330 // VULMON: CVE-2022-37301 // CNNVD: CNNVD-202211-3279 // NVD: CVE-2022-37301

SOURCES

db:CNVDid:CNVD-2022-86330
db:VULMONid:CVE-2022-37301
db:CNNVDid:CNNVD-202211-3279
db:NVDid:CVE-2022-37301

LAST UPDATE DATE

2024-08-14T14:49:30.221000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-86330date:2022-12-09T00:00:00
db:VULMONid:CVE-2022-37301date:2022-11-22T00:00:00
db:CNNVDid:CNNVD-202211-3279date:2022-12-01T00:00:00
db:NVDid:CVE-2022-37301date:2022-11-30T20:23:57.423

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-86330date:2022-12-07T00:00:00
db:VULMONid:CVE-2022-37301date:2022-11-22T00:00:00
db:CNNVDid:CNNVD-202211-3279date:2022-11-22T00:00:00
db:NVDid:CVE-2022-37301date:2022-11-22T12:15:09.927