Skip to content
OpenAdvisories
Critical ICSA-21-194-02 6 CVEs

Schneider Electric Modicon Controllers and Software (Update A)

Published Jul 13, 2021 · Updated Jul 27, 2021 · Revision 2

Vendor: Schneider Electric Product: EcoStruxure Control Expert Product: EcoStruxure™ Process Expert Product: Modicon M340 CPU (part numbers BMXP34*) Product: Modicon M580 CPU (part numbers BMEP* and BMEH*) Product: SCADAPack RemoteConnect for x70

Summary

Successful exploitation of these vulnerabilities may allow arbitrary code execution and loss of confidentiality and integrity of the project file.

Vulnerabilities 6

  • High 7.3
    CVE-2020-12525

    WAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component

    M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.

    Weidmüller M&M Software Pepperl+Fuchs/PACTware WI Manager
  • Medium 6.5
    CVE-2021-22779

    Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, …

  • Unscored —
    CVE-2021-22778

    Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP…

  • Unscored —
    CVE-2021-22780

    Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP…

  • Unscored —
    CVE-2021-22781

    Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP…

  • Unscored —
    CVE-2021-22782

    Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP…

Revision history

  1. #2

    ICSA-21-194-02 Schneider Electric Modicon Controllers and Software (Update A)

  2. #1

    ICSA-21-194-02 Schneider Electric SCADApack RTU, Modicon Controllers, and Software

References