PT-2020-6392 · Schneider Electric · Modicon Premium Processors+5

Published 2020-09-21 · Updated 2026-05-29 · CVE-2021-22787

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Modicon M340 CPUs versions prior to V3.40 Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions) Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions) Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions) Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions) Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)

Description A vulnerability exists due to improper input validation, which could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device. This can be achieved by sending specially formed GET requests to port 80.

Recommendations For Modicon M340 CPUs versions prior to V3.40, update to version V3.40 or later. For Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU, restrict access to the web server to minimize the risk of exploitation. For Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634, consider disabling the web server until a patch is available. For Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx, Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101, and Modicon Premium Communication Modules: TSXETY4103, TSXETY5103, avoid using the vulnerable HTTP endpoint until the issue is resolved. As a temporary workaround, consider blocking specially crafted GET requests to port 80.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-04568

CVE-2021-22787

Affected Products

Modicon M340 Cpu

Modicon M340 X80 Ethernet Communication Modules

Modicon Premium Communication Modules

Modicon Premium Processors

Modicon Quantum Communication Modules

Modicon Quantum Processors

References · 7

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22787 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04568 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22787 · Security Note
• http://web.archive.org/web/20161210032016/https://ics-cert.us-cert.gov/advisories/ICSA-15-013-03 · Note
• https://t.me/cibsecurity/37318 · Telegram Post
• https://t.me/cveNotify/165267 · Telegram Post