PT-2021-7828 · Schneider Electric · Modicon Mc80+7

Published 2021-08-10 · Updated 2021-09-13 · CVE-2021-22792

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Modicon M580 CPU versions all Modicon M340 CPU versions all Modicon MC80 versions all Modicon Momentum Ethernet CPU versions all PLC Simulator for EcoStruxure Control Expert versions all PLC Simulator for EcoStruxure Process Expert versions all Modicon Quantum CPU versions all Modicon Premium CPU versions all

Description The issue is related to a NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller or simulator when updating the controller application with a specially crafted project file. This vulnerability is associated with the exploitation of a null pointer dereference, which can be triggered remotely.

Recommendations For Modicon M580 CPU, update to a version that includes a fix for this issue. For Modicon M340 CPU, update to a version that includes a fix for this issue. For Modicon MC80, update to a version that includes a fix for this issue. For Modicon Momentum Ethernet CPU, update to a version that includes a fix for this issue. For PLC Simulator for EcoStruxure Control Expert, update to a version that includes a fix for this issue. For PLC Simulator for EcoStruxure Process Expert, update to a version that includes a fix for this issue. For Modicon Quantum CPU, update to a version that includes a fix for this issue. For Modicon Premium CPU, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the controller application update functionality until a patch is available.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2023-03446

CVE-2021-22792

Affected Products

Modicon M340 Cpu

Modicon M580 Cpu

Modicon Mc80

Modicon Momentum Ethernet Cpu

Modicon Premium Cpu

Modicon Quantum Cpu

Plc Simulator For Ecostruxure Control Expert

Plc Simulator For Ecostruxure Process Expert

References · 6

• https://bdu.fstec.ru/vul/2023-03446 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22792 · Security Note
• https://vuldb.com/?id.181984 · Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-07 · Note
• https://t.me/cibsecurity/28232 · Telegram Post