Schneider Electric EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers Improper Check For Unusual or Exceptional Conditions (CVE-2022-45788)

critical Tenable OT Security Plugin ID 500880

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products:
EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (Versions prior to V2020), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions), Modicon Momentum Unity M1E Processor - 171CBU* (All Versions), Modicon MC80 - BMKC80 (All Versions), Legacy Modicon Quantum - 140CPU65* and Premium CPUs - TSXP57* (All Versions)

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Schneider Electric released the following remediations for users to implement:

- EcoStruxure Process Expert: Version V2021 available for download and is not impacted by this vulnerability, as the affected component has been removed from this version.
- EcoStruxure Control Expert: Software V15.3 includes a fix for this vulnerability and is available for download.
- Modicon M580 (part numbers BMEP* and BMEH*, excluding M580 CPU Safety): Firmware SV4.10 includes a fix for this vulnerability and is available for download.
- Modicon Momentum Unity M1E Processor (part numbers 171CBU*): Firmware VS2.6 includes a fix for this vulnerability and is available for download.
- Modicon M340 CPU (part numbers BMXP34*): Firmware SV3.51 includes a fix for this vulnerability and is available for download.
- Modicon MC80 CPU (part numbers BMKC80*): Firmware SV1.90 includes a fix for this vulnerability and is available for download.

Users should use appropriate patching methodologies when applying these patches to their systems. Schneider Electric recommends using backups and evaluating the impact of these patches in a “testing and development environment” or on an offline infrastructure.

Users should contact Schneider Electric for assistance in removing a patch.

Users should apply the best practices for network hardening as documented in the product user guide and the Schneider Electric Recommended Cybersecurity Best Practices.

For more information, see Schneider Electric’s security advisory SEVD-2023-010-05.

Plugin Details

Severity: Critical

ID: 500880

Version: 1.6

Type: remote

Family: Tenable.ot

Published: 3/9/2023

Updated: 3/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-45788

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:schneider-electric:modicon_m340_bmxp341000_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp342000_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp3420102_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp342010_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp342020_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp342020h_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp3420302_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp3420302h_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp342030_firmware:-, cpe:/o:schneider-electric:modicon_m340_bmxp342030h_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh582040_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh582040c_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh582040s_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh584040_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh584040c_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh584040s_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh586040_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh586040c_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmeh586040s_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep581020_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep581020h_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep582020_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep582020h_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep582040_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep582040h_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep582040s_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep583020_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep583040_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep584020_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep584040_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep584040s_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep585040_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep585040c_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep586040_firmware:-, cpe:/o:schneider-electric:modicon_m580_bmep586040c_firmware:-, cpe:/o:schneider-electric:modicon_mc80_bmkc8020301_firmware:-, cpe:/o:schneider-electric:modicon_mc80_bmkc8020310_firmware:-, cpe:/o:schneider-electric:modicon_mc80_bmkc8030311_firmware:-, cpe:/o:schneider-electric:modicon_momentum_171cbu78090_firmware:-, cpe:/o:schneider-electric:modicon_momentum_171cbu98090_firmware:-, cpe:/o:schneider-electric:modicon_momentum_171cbu98091_firmware:-, cpe:/o:schneider-electric:modicon_premium_tsxp57_1634m_firmware:-, cpe:/o:schneider-electric:modicon_premium_tsxp57_2634m_firmware:-, cpe:/o:schneider-electric:modicon_premium_tsxp57_2834m_firmware:-, cpe:/o:schneider-electric:modicon_premium_tsxp57_454m_firmware:-, cpe:/o:schneider-electric:modicon_premium_tsxp57_4634m_firmware:-, cpe:/o:schneider-electric:modicon_premium_tsxp57_554m_firmware:-, cpe:/o:schneider-electric:modicon_premium_tsxp57_5634m_firmware:-, cpe:/o:schneider-electric:modicon_premium_tsxp57_6634m_firmware:-, cpe:/o:schneider-electric:modicon_quantum_140cpu65150_firmware:-, cpe:/o:schneider-electric:modicon_quantum_140cpu65150c_firmware:-, cpe:/o:schneider-electric:modicon_quantum_140cpu65160_firmware:-, cpe:/o:schneider-electric:modicon_quantum_140cpu65160c_firmware:-

Required KB Items: Tenable.ot/Schneider

Exploit Ease: No known exploits are available

Patch Publication Date: 1/30/2023

Vulnerability Publication Date: 1/30/2023

Reference Information

CVE: CVE-2022-45788

CWE: 754

Detections

Analytics