Skip to content
OpenAdvisories
Critical SEVD-2021-313-05 3 CVEs

BadAlloc Vulnerabilities

Published Nov 9, 2021 · Updated Sep 9, 2025 · Revision 30

Vendor: Schneider Electric Product: 140CRA31200 (Quantum RIO Drop) Product: 140CRA31908 (M580 Quantum S908 RIO Drop Adapter) Product: 6100A Product: 6100XIO Product: 6180A Product: 6180XIO Product: AeroDAQ Product: BMEAHI0812 Product: BMEAHO0412 Product: BMECRA31210 Product: BMECXM0100 Product: BMENOC0301 Product: BMENOC0311 Product: BMENOC0321 Product: BMENOP0300 Product: BMENOS0300 Product: BMXCRA31200 Product: BMXCRA31210 Product: BMXNGD0100 Product: BMXNOC0401 Product: BMXNOE0100 (H) Product: BMXNOE0110 (H) Product: BMXNOM0200 Product: BMXNOR0200 (H) RTU Product: E+PLC100 Product: E+PLC400 Product: Easergy Product: Easergy MiCOM P30 Product: Easergy MiCOM P40 +60 more

Summary

Schneider Electric is aware of multiple memory allocation vulnerabilities dubbed 'BadAlloc', disclosed by
Microsoft on April 29, 2021. The impact of a successful exploitation of the vulnerabilities may result in denial of
service, or remote code execution, depending on the context.

September 2025 Update: Corrected and updated affected versions for EPC2000, EPC3000, Eurotherm E+PLC400, Eurotherm Eycon 10/20 Visual Supervisor, Eurotherm T2550 PAC, and Eurotherm T2750 PAC.

Vulnerabilities 3

  • Critical 9.0
    CVE-2021-22156

    An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry®…

    BlackBerry QNX Software Development Platform (SDP), QNX OS for Medical and QNX OS for Safety
  • High 7.3
    CVE-2020-28895

    integer overflow in calloc

    In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corrupti…

  • Unscored —
    CVE-2020-35198

    An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a …

Revision history

  1. #28.0.0

    Corrected and updated affected versions for EPC2000, EPC3000, Eurotherm E+PLC400, Eurotherm Eycon 10/20 Visual Supervisor, Eurotherm T2550 PAC, and Eurotherm T2750 PAC.

  2. #27.0.0

    Remediations are available for 140CRA31200 (Quantum RIO Drop), 140CRA31908 (M580 Quantum S908 RIO Drop Adapter) (Page 13), and BMENOP0300 (Page 14).

  3. #26.0.0

    A remediation is available for BMECRA31210, BMXCRA31200, BMXCRA31210 (Page 13) and mitigations for this product have been updated.

  4. #25.0.0

    A remediation is available for Modicon X80 module, part number BMENOS0300 (Page 10).

  5. #24.0.0

    Changes have been made to the Easergy MiCOM P30 remediation description and we have added model P638 to the list of Easergy MiCOM P30s with a remediation.

  6. #23.0.0

    A remediation is available on HMISTU (page 4).

  7. #22.0.0

    A remediation is available on Modicon M580 CPU Safety.

  8. #21.0.0

    Easergy MiCOM P30 range models 139 and 436 were added to Affected Products.

  9. #20.0.0

    A remediation is now available for HART IO X80 Module (part number BMEAHI0812, BMEAHO0412).

  10. #19.0.0

    A remediation is now available for Modicon X80 Module (part number BMXNOM0200).

  11. #18.0.0

    Remediations are now available for Modicon M580 Ethernet Communication Modules BMENOC*.

  12. #17.0.0

    Remediations for the following products are now available: Easergy MiCOM P30 range models P139, P437, P439, P532, P631, P632, P633, P634, C434 (page 2), Modicon M580 CPU part numbers BMEP* and BMEH (page 7), and Modicon Momentum Unity M1E Processor part numbers 171CBU* (page 8). Mitigations for Easergy MiCOM P30 range, models P138, P436, P438, P132, P433, P435 have been added.

  13. #16.0.0

    There is a remediation for Modicon M340 Ethernet Communication Modules BMXNOE0100 (H) and BMXNOE0110 (H) products.

  14. #15.0.0

    There are remediations available for Easergy MiCOM P30 range and Pro-face LT4000M Series.

  15. #14.0.0

    The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities.

  16. #13.0.0

    A remediation is now available for EPC2000.

  17. #12.0.0

    Easergy MiCOM P30 range P632 and P633 were added as affected models along with a remediation. Final mitigations were added for Modicon Momentum ENT. Adding a clarification to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges; the latest fix Modicon M580 v4.02 does not apply to the Safety range of M580.

  18. #11.0.0

    Final Remediations available for Modicon M340 Modules BMXNOC0401 and BMXNOR0200H RTU, and Modicon MC80 Controller (BMKC8*). There is a mitigation available for Profibus Remote Master (TCSEGPA23F14F) and CANopen X80 Communication Module (BMECXM0100).

  19. #10.0.0

    Remediations available for Modicon M580 CPU (BMEP* and BMEH*) and Pro-face GP4000 Series, GP4000H Series GP-Pro EX.

  20. #9.0.0

    Remediation added for Versadac. The previously added remediation for EPC2000 has been removed as v4.03 is not yet available, this document will be updated when it is released.

  21. #8.0.0

    Added a remediation for EPC2000, v4.03 includes a fix.

  22. #7.0.0

    Added a remediation for HMISCU, added the following affected models to the Easergy MiCOM P30 range: C434, P132, P139, P433, P435, P437, P532, P631, P632, P633, P634, Px36/8.

  23. #6.0.0

    Added remediations for Eurotherm E+PLC400, Eurotherm T2750 PAC and Modicon M340 CPU. Additionally, Eurotherm T2550 PAC and Eurotherm Eycon 10/20 Visual Supervisor have been added as affected products to this security notification in the remediation section.

  24. #5.0.0

    Available remediations for Easy Harmony ET6 (HMIET Series), Easy Harmony GXU (HMIGXU Series), Harmony/ Magelis (HMIGTU Series, HMIGTUX Series, HMIGK Series), Modicon M262 Logic Controllers, and Modicon M241/M251 Logic Controllers. Added Easergy MiCOM P30 and Easergy MiCOM P40 to the list of affected products.

  25. #4.1.0

    Moved back to affected products section: Harmony/ Magelis HMIGTU Series, HMIGTUX Series, HMIGK Series.

References