cnvd-2022-68927
Vulnerability from cnvd
Title
Schneider Electric多款产品输入验证错误漏洞
Description
Schneider Electric Modicon Quantum和Schneider Electric Modicon M340都是法国施耐德电气（Schneider Electric）公司的产品。Schneider Electric Modicon Quantum是一款用于过程应用、高可用性和安全解决方案的大型可编程逻辑控制器（PLC）。Schneider Electric Modicon M340是一款用于工业过程和基础设施的中程PLC（可编程逻辑控制器）。 Schneider Electric多款产品存在输入验证错误漏洞，攻击者可利用该漏洞向设备的Web服务器发送特制的HTTP请求，导致设备拒绝服务。
Severity
中
Patch Name
Schneider Electric多款产品输入验证错误漏洞的补丁
Patch Description
Schneider Electric Modicon M340是法国施耐德电气（Schneider Electric）公司的一款用于工业过程和基础设施的中程PLC（可编程逻辑控制器）。 Schneider Electric多款产品存在输入验证错误漏洞，攻击者可利用该漏洞向设备的Web服务器发送特制的HTTP请求，导致设备拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02

Reference
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02
Impacted products
Name
['Schneider Electric Modicon M340 CPUs BMXP34 (<=3.40)', 'Schneider Electric Modicon M340 X80 Ethernet Communication Modules BMXNOE0100(H)', 'Schneider Electric Modicon M340 X80 Ethernet Communication Modules BMXNOE0110(H)', 'Schneider Electric Modicon M340 X80 Ethernet Communication Modules BMXNOC0401', 'Schneider Electric Modicon M340 X80 Ethernet Communication Modules BMXNOR0200H RTU(All Versions)', 'Schneider Electric Modicon Premium Processors with integrated Ethernet (Copro) TSXP574634', 'Schneider Electric Modicon Premium Processors with integrated Ethernet (Copro) TSXP575634', 'Schneider Electric Modicon Premium Processors with integrated Ethernet (Copro) TSXP576634(All Versions)', 'Schneider Electric Modicon Premium Processors with integrated Ethernet (Copro) 140CPU65xxxxx(All Versions)', 'Schneider Electric Modicon Quantum Communication Modules 140NOE771x1', 'Schneider Electric Modicon Quantum Communication Modules 140NOC78x00', 'Schneider Electric Modicon Quantum Communication Modules 140NOC77101(All Versions)', 'Schneider Electric Modicon Quantum Communication Modules TSXETY4103', 'Schneider Electric Modicon Quantum Communication Modules TSXETY5103(All Versions)']
Show details on source website

To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-22787",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-22787"
    }
  },
  "description": "Schneider Electric Modicon Quantum\u548cSchneider Electric Modicon M340\u90fd\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Schneider Electric Modicon Quantum\u662f\u4e00\u6b3e\u7528\u4e8e\u8fc7\u7a0b\u5e94\u7528\u3001\u9ad8\u53ef\u7528\u6027\u548c\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u7684\u5927\u578b\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\uff08PLC\uff09\u3002Schneider Electric Modicon M340\u662f\u4e00\u6b3e\u7528\u4e8e\u5de5\u4e1a\u8fc7\u7a0b\u548c\u57fa\u7840\u8bbe\u65bd\u7684\u4e2d\u7a0bPLC\uff08\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\uff09\u3002\n\nSchneider Electric\u591a\u6b3e\u4ea7\u54c1\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5411\u8bbe\u5907\u7684Web\u670d\u52a1\u5668\u53d1\u9001\u7279\u5236\u7684HTTP\u8bf7\u6c42\uff0c\u5bfc\u81f4\u8bbe\u5907\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-68927",
  "openTime": "2022-10-14",
  "patchDescription": "Schneider Electric Modicon M340\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u5de5\u4e1a\u8fc7\u7a0b\u548c\u57fa\u7840\u8bbe\u65bd\u7684\u4e2d\u7a0bPLC\uff08\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\uff09\u3002\r\n\r\nSchneider Electric\u591a\u6b3e\u4ea7\u54c1\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5411\u8bbe\u5907\u7684Web\u670d\u52a1\u5668\u53d1\u9001\u7279\u5236\u7684HTTP\u8bf7\u6c42\uff0c\u5bfc\u81f4\u8bbe\u5907\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Schneider Electric\u591a\u6b3e\u4ea7\u54c1\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Schneider Electric Modicon M340 CPUs BMXP34 (\u003c=3.40)",
      "Schneider Electric Modicon M340 X80 Ethernet Communication Modules BMXNOE0100(H)",
      "Schneider Electric Modicon M340 X80 Ethernet Communication Modules BMXNOE0110(H)",
      "Schneider Electric Modicon M340 X80 Ethernet Communication Modules BMXNOC0401",
      "Schneider Electric Modicon M340 X80 Ethernet Communication Modules BMXNOR0200H RTU(All Versions)",
      "Schneider Electric Modicon Premium Processors with integrated Ethernet (Copro) TSXP574634",
      "Schneider Electric Modicon Premium Processors with integrated Ethernet (Copro) TSXP575634",
      "Schneider Electric Modicon Premium Processors with integrated Ethernet (Copro) TSXP576634(All Versions)",
      "Schneider Electric Modicon Premium Processors with integrated Ethernet (Copro) 140CPU65xxxxx(All Versions)",
      "Schneider Electric Modicon Quantum Communication Modules 140NOE771x1",
      "Schneider Electric Modicon Quantum Communication Modules 140NOC78x00",
      "Schneider Electric Modicon Quantum Communication Modules 140NOC77101(All Versions)",
      "Schneider Electric Modicon Quantum Communication Modules TSXETY4103",
      "Schneider Electric Modicon Quantum Communication Modules TSXETY5103(All Versions)"
    ]
  },
  "referenceLink": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02",
  "serverity": "\u4e2d",
  "submitTime": "2022-02-15",
  "title": "Schneider Electric\u591a\u6b3e\u4ea7\u54c1\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.