Description
CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the
product when an unauthenticated user is sending a crafted HTTPS packet to the webserver.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety) | Versions prior to SV4.30 | — |
| Schneider Electric | Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) | Versions prior to SV4.21 | — |
| Schneider Electric | BMENOR2200H | All Versions | — |
| Schneider Electric | EVLink Pro AC | Versions prior to v1.3.10 | — |
Advisories 3
- ICSA-25-035-04 Schneider Electric EcoStruxure Power Monitoring Expert (PME) (Update A) CISA ICS & IT advisories · Apr 8, 2025
- SEVD-2025-014-01 Modicon M580 PLCs, BMENOR2200H and EVLink Pro AC Schneider Electric CPCERT · Apr 8, 2025
- NCSC-2025-0019 Kwetsbaarheden verholpen in Schneider Electric Modicon NCSC-NL (Netherlands) · Jan 16, 2025