CVE-2022-37301: Integer Underflow
Published Nov 22, 2022
·Updated
A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34)(V3.40 and prior), Modicon M580 CPU (part numbers BMEP and BMEH)(V3.22 and prior), Legacy Modicon Quantum/Premium(All Versions), Modicon Momentum MDI (171CBU)(All Versions), Modicon MC80 (BMKC80)(V1.7 and prior)
Affected Software
96 affected components
Schneider-electric Modicon M340 Bmx P34-2010 Firmware<3.50
Schneider-electric Modicon M340 Bmx P34-2010
Schneider-electric Modicon M340 Bmx P34-2030 Firmware<3.50
Schneider-electric Modicon M340 Bmx P34-2030
Schneider-electric Modicon M580 Bmeh582040 Firmware<4.01
Schneider-electric Modicon M580 Bmeh582040
Schneider-electric Modicon M580 Bmeh582040c Firmware<4.01
Schneider-electric Modicon M580 Bmeh582040c
Schneider-electric Modicon M580 Bmeh582040s Firmware<4.01
Schneider-electric Modicon M580 Bmeh582040s
Schneider-electric Modicon M580 Bmeh584040 Firmware<4.01
Schneider-electric Modicon M580 Bmeh584040
Schneider-electric Modicon M580 Bmeh584040c Firmware<4.01
Schneider-electric Modicon M580 Bmeh584040c
Schneider-electric Modicon M580 Bmeh584040s Firmware<4.01
Schneider-electric Modicon M580 Bmeh584040s
Schneider-electric Modicon M580 Bmeh586040 Firmware<4.01
Schneider-electric Modicon M580 Bmeh586040
Schneider-electric Modicon M580 Bmeh586040c Firmware<4.01
Schneider-electric Modicon M580 Bmeh586040c
Schneider-electric Modicon M580 Bmeh586040s Firmware<4.01
Schneider-electric Modicon M580 Bmeh586040s
Schneider-electric Modicon M580 Bmep581020 Firmware<4.01
Schneider-electric Modicon M580 Bmep581020
Schneider-electric Modicon M580 Bmep581020h Firmware<4.01
Schneider-electric Modicon M580 Bmep581020h
Schneider-electric Modicon M580 Bmep582020 Firmware<4.01
Schneider-electric Modicon M580 Bmep582020
Schneider-electric Modicon M580 Bmep582020h Firmware<4.01
Schneider-electric Modicon M580 Bmep582020h
Schneider-electric Modicon M580 Bmep582040 Firmware<4.01
Schneider-electric Modicon M580 Bmep582040
Schneider-electric Modicon M580 Bmep582040h Firmware<4.01
Schneider-electric Modicon M580 Bmep582040h
Schneider-electric Modicon M580 Bmep582040s Firmware<4.01
Schneider-electric Modicon M580 Bmep582040s
Schneider-electric Modicon M580 Bmep583020 Firmware<4.01
Schneider-electric Modicon M580 Bmep583020
Schneider-electric Modicon M580 Bmep583040 Firmware<4.01
Schneider-electric Modicon M580 Bmep583040
Schneider-electric Modicon M580 Bmep584020 Firmware<4.01
Schneider-electric Modicon M580 Bmep584020
Schneider-electric Modicon M580 Bmep584040 Firmware<4.01
Schneider-electric Modicon M580 Bmep584040
Schneider-electric Modicon M580 Bmep584040s Firmware<4.01
Schneider-electric Modicon M580 Bmep584040s
Schneider-electric Modicon M580 Bmep585040 Firmware<4.01
Schneider-electric Modicon M580 Bmep585040
Schneider-electric Modicon M580 Bmep585040c Firmware<4.01
Schneider-electric Modicon M580 Bmep585040c
Schneider-electric Modicon M580 Bmep586040 Firmware<4.01
Schneider-electric Modicon M580 Bmep586040
Schneider-electric Modicon M580 Bmep586040c Firmware<4.01
Schneider-electric Modicon M580 Bmep586040c
Schneider-electric Modicon Mc80 Bmkc8020301 Firmware<1.8
Schneider-electric Modicon Mc80 Bmkc8020301
Schneider-electric Modicon Mc80 Bmkc8020310 Firmware<1.8
Schneider-electric Modicon Mc80 Bmkc8020310
Schneider-electric Modicon Mc80 Bmkc8030311 Firmware<1.8
Schneider-electric Modicon Mc80 Bmkc8030311
Schneider-electric Modicon Momentum 171cbu78090 Firmware
Schneider-electric Modicon Momentum 171cbu78090
Schneider-electric Modicon Momentum 171cbu98090 Firmware
Schneider-electric Modicon Momentum 171cbu98090
Schneider-electric Modicon Momentum 171cbu98091 Firmware
Schneider-electric Modicon Momentum 171cbu98091
Schneider-electric Modicon Premium Tsxp57 1634m Firmware
Schneider-electric Modicon Premium Tsxp57 1634m
Schneider-electric Modicon Premium Tsxp57 2634m Firmware
Schneider-electric Modicon Premium Tsxp57 2634m
Schneider-electric Modicon Premium Tsxp57 2834m Firmware
Schneider-electric Modicon Premium Tsxp57 2834m
Schneider-electric Modicon Premium Tsxp57 454m Firmware
Schneider-electric Modicon Premium Tsxp57 454m
Schneider-electric Modicon Premium Tsxp57 4634m Firmware
Schneider-electric Modicon Premium Tsxp57 4634m
Schneider-electric Modicon Premium Tsxp57 554m Firmware
Schneider-electric Modicon Premium Tsxp57 554m
Schneider-electric Modicon Premium Tsxp57 5634m Firmware
Schneider-electric Modicon Premium Tsxp57 5634m
Schneider-electric Modicon Premium Tsxp57 6634m Firmware
Schneider-electric Modicon Premium Tsxp57 6634m
Schneider-electric Modicon Quantum 140cpu65150 Firmware
Schneider-electric Modicon Quantum 140cpu65150
Schneider-electric Modicon Quantum 140cpu65150c Firmware
Schneider-electric Modicon Quantum 140cpu65150c
Schneider-electric Modicon Quantum 140cpu65160 Firmware
Schneider-electric Modicon Quantum 140cpu65160
Schneider-electric Modicon Quantum 140cpu65160c Firmware
Schneider-electric Modicon Quantum 140cpu65160c
Schneider-electric Modicon Quantum 140noc78100 Firmware
Schneider-electric Modicon Quantum 140noc78100
Schneider-electric Modicon Quantum 140noe77101 Firmware
Schneider-electric Modicon Quantum 140noe77101
Schneider-electric Modicon Quantum 140noe77111 Firmware
Schneider-electric Modicon Quantum 140noe77111
Event History
Nov 22, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-37301?
CVE-2022-37301 is considered a high-severity vulnerability due to its potential to cause denial of service through memory access violations.
2
How do I fix CVE-2022-37301?
To fix CVE-2022-37301, update your Schneider Electric Modicon M340 CPU or Modicon M580 CPU firmware to version 3.50 or later, respectively.
3
What products are affected by CVE-2022-37301?
CVE-2022-37301 affects Schneider Electric Modicon M340 CPUs with firmware V3.40 and prior, as well as Modicon M580 CPUs with firmware up to V4.01.
4
What type of vulnerability is CVE-2022-37301?
CVE-2022-37301 is classified as an Integer Underflow vulnerability, specifically associated with the Modbus TCP protocol.
5
What can attackers achieve by exploiting CVE-2022-37301?
Exploitation of CVE-2022-37301 can lead to denial of service conditions affecting the control system.