CVE-2022-37300
high-risk
Published 2022-09-12
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).
Do I need to act?
-
0.57% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (20)
Ecostruxure Process Expert
Modicon M340 Bmxp342010 Firmware
Modicon M340 Bmxp342020H Firmware
Modicon M340 Bmxp342030 Firmware
Modicon M340 Bmxp3420302H Firmware
Modicon M340 Bmxp342030H Firmware
Modicon M580 Bmeh582040 Firmware
Modicon M580 Bmeh582040C Firmware
Modicon M580 Bmeh582040S Firmware
Modicon M580 Bmeh584040 Firmware
Modicon M580 Bmeh584040C Firmware
Modicon M580 Bmeh584040S Firmware
Modicon M580 Bmeh586040 Firmware
Modicon M580 Bmeh586040C Firmware
Affected Vendors
57
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
2/34 · Minimal
Exposure
23/34 · High