Skip to content
OpenAdvisories
High SEVD-2022-193-01 7 CVEs

OPC UA and X80 advanced RTU Modicon Communication Modules

Published Jul 12, 2022 · Updated Aug 19, 2022 · Revision 3

Vendor: Schneider Electric Product: OPC UA Modicon Communication Module (BMENUA0100) Product: X80 advanced RTU Communication Module (BMENOR2200H)

Summary

Schneider Electric is aware of multiple vulnerabilities in its BMENUA0100 - OPC UA module and BMENOR2200H X80 advanced RTU communication module for M580.
The BMENUA0100 - OPC UA module for M580 is an Ethernet communications module with an embedded OPC UA server for communication with OPC UA clients, including SCADA.
The BMENOR2200H – X80 advanced RTU module is an Ethernet communication module that enables M580 platform to use RTU protocol exchange with RTU stations.
Failure to apply the mitigations provided below may introduce risks including denial of service of the webserver and bypass of the secure boot process, which could result in running an unauthorized firmware.

Vulnerabilities 7

Revision history

  1. #3.0.0

    There are remediations available for the OPC UA Modicon Communication Module (BMENUA0100) (page 3) and X80 advanced RTU Communication Module (BMENOR2200)

  2. #2.0.0

    A fix is available for the OPC UA Modicon Communication Module (BMENUA0100) that addresses the multiple vulnerabilities reported.

  3. #1.0.0

    Original Release

References