CVE-2021-22792: Null Pointer Dereference
A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP and BMEH, all versions), Modicon M340 CPU (part numbers BMXP34, all versions), Modicon MC80 (part numbers BMKC80, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU, all versions), Modicon Premium CPU (part numbers TSXP5, all versions).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-22792?
CVE-2021-22792 is a NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file.
Which software versions are affected by CVE-2021-22792?
CVE-2021-22792 affects Modicon M340 CPU and Modicon M580 CPU with various part numbers and versions.
What is the severity of CVE-2021-22792?
CVE-2021-22792 has a severity score of 7.5, which is classified as high.
How can CVE-2021-22792 be exploited?
CVE-2021-22792 can be exploited by updating the Modicon PLC controller application with a specially crafted project file.
Are there any references for CVE-2021-22792?
Yes, you can refer to the following links for more information on CVE-2021-22792: [Reference 1](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04) and [Reference 2](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-07)