Vulnerability in Schneider Electric Ecostruxure Control Expert
CVE-2022-37300
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).
EPSS: 0.007 (48.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Schneider Electric Ecostruxure Control Expert — versions SP1
- Schneider Electric Ecostruxure Process Expert — versions V
- Schneider Electric Modicon M340 Cpu — versions BMXP34
- Schneider Electric Modicon M580 Cpu — versions BMEP, BMEH
- Schneider-electric Ecostruxure_control_expert
- Schneider-electric Ecostruxure_process_expert
- Schneider-electric Modicon_m340_bmxp341000
- Schneider-electric Modicon_m340_bmxp341000_firmware
- Schneider-electric Modicon_m340_bmxp342000
- Schneider-electric Modicon_m340_bmxp342000_firmware
Weakness classification (CWE)
References
- cybersecurity@se.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-37300?
- CVE-2022-37300 is a critical-severity vulnerability in Schneider Electric Ecostruxure Control Expert, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 9.8/10. Published 2022-09-12.
- How severe is CVE-2022-37300?
- Critical severity. CVSS v3 base score is 9.8 out of 10.