Description
A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34*)(V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*)(V3.22 and prior), Legacy Modicon Quantum/Premium(All Versions), Modicon Momentum MDI (171CBU*)(All Versions), Modicon MC80 (BMKC80)(V1.7 and prior)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Modicon M340 CPU (part numbers BMXP34*) | V – ≤ 3.40 | — |
| Schneider Electric | Modicon M580 CPU (part numbers BMEP* and BMEH*) | V – ≤ 3.22 | — |
| Schneider Electric | Legacy Modicon Quantum/Premium | All Versions | — |
| Schneider Electric | Modicon Momentum MDI (171CBU*) | All Versions | — |
| Schneider Electric | Modicon MC80 (BMKC80) | V – ≤ 1.7 | — |
Advisories 1
- SEVD-2022-221-02 Modicon PAC Controllers Schneider Electric CPCERT · Aug 13, 2024