PT-2022-9278 · Schneider Electric · Modicon M218 Logic Controller

Published 2022-02-11 · Updated 2022-02-18 · CVE-2021-22800

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Modicon M218 Logic Controller versions prior to V5.1.0.6

Description A vulnerability exists due to improper input validation, which could cause a Denial of Service when a crafted packet is sent to the controller over network port 1105/TCP.

Recommendations For versions prior to V5.1.0.6, update to a version newer than V5.1.0.6 to resolve the issue. As a temporary workaround, consider restricting access to network port 1105/TCP to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-22800

Affected Products

Modicon M218 Logic Controller

References · 3

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-285-04 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22800 · Security Note