CVE-2022-22724

A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 (All Versions)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
schneiderCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
VendorProductVersion
schneider-electricmodicon_m340_bmxp341000_firmware
-
schneider-electricmodicon_m340_bmxp342000_firmware
-
schneider-electricmodicon_m340_bmxp342010_firmware
-
schneider-electricmodicon_m340_bmxp3420102_firmware
-
schneider-electricmodicon_m340_bmxp342000_firmware
-
schneider-electricmodicon_m340_bmxp342030_firmware
-
schneider-electricmodicon_m340_bmxp3420302_firmware
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01