CVE-2021-22749: Infoleak
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could cause information leak concerning the current RTU configuration including communication parameters dedicated to telemetry, when a specially crafted HTTP request is sent to the web server of the module.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-22749?
CVE-2021-22749 is classified as a medium severity vulnerability due to potential information leakage.
How do I fix CVE-2021-22749?
To mitigate CVE-2021-22749, update the Modicon X80 BMXNOR0200H RTU firmware to versions SV1.70 IR23 or later.
What types of information are exposed by CVE-2021-22749?
CVE-2021-22749 can leak sensitive information about the current RTU configuration, including communication parameters related to telemetry.
Which products are affected by CVE-2021-22749?
CVE-2021-22749 affects the Schneider Electric Modicon X80 BMXNOR0200H RTU firmware versions SV1.70 IR22 and earlier.
What can be done to prevent exploitation of CVE-2021-22749?
To prevent exploitation of CVE-2021-22749, ensure that all affected devices are updated to the latest firmware version.