CVE-2022-37300

State: Published
Severity: 9.8 Critical
Published: Sep 12, 2022
Updated: Aug 3, 2024
Reserved: Aug 1, 2022

Description

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	schneider

Weaknesses

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

Affected Products

Product	Versions
EcoStruxure Control ExpertSchneider Electric	SP1 through 15.0Affected
EcoStruxure Process ExpertSchneider Electric	V through 2021Affected
Modicon M340 CPUSchneider Electric	BMXP34 through 3.40Affected
Modicon M580 CPUSchneider Electric	BMEP through 3.20Affected BMEH through 3.20Affected

References

https://www.se.com/us/en/download/document/SEVD-2022-221-01/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.