modicon_m580_bmep586040c Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/modicon_m580_bmep586040c/ Sun, 26 Feb 2023 06:51:11 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png modicon_m580_bmep586040c Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/modicon_m580_bmep586040c/ 32 32 CVE-2018-7838 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7838/ Sun, 26 Feb 2023 06:51:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7838/ A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU – BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater […]

The post CVE-2018-7838 appeared first on CVE Vulnerability.

]]> A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU – BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.

The post CVE-2018-7838 appeared first on CVE Vulnerability.

]]> CVE-2021-22792 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22792/ Thu, 23 Feb 2023 14:07:24 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22792/ A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers […]

The post CVE-2021-22792 appeared first on CVE Vulnerability.

]]> A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).

The post CVE-2021-22792 appeared first on CVE Vulnerability.

]]> CVE-2021-22779 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22779/ Thu, 23 Feb 2023 14:07:23 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22779/ Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions – part numbers BMEP* and […]

The post CVE-2021-22779 appeared first on CVE Vulnerability.

]]> Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions – part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions – part numbers BMXP34*), that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.

The post CVE-2021-22779 appeared first on CVE Vulnerability.

]]> CVE-2021-22786 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22786/ Thu, 23 Feb 2023 14:07:23 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22786/ A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communicating over the Modbus TCP protocol. Affected Products: Modicon M340 CPU (part numbers BMXP34*) (Versions prior to V3.30), Modicon M580 CPU (part numbers BMEP* and BMEH*) (Versions prior to SV3.20), Modicon MC80 (BMKC80) […]

The post CVE-2021-22786 appeared first on CVE Vulnerability.

]]> A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communicating over the Modbus TCP protocol. Affected Products: Modicon M340 CPU (part numbers BMXP34*) (Versions prior to V3.30), Modicon M580 CPU (part numbers BMEP* and BMEH*) (Versions prior to SV3.20), Modicon MC80 (BMKC80) (Versions prior to V1.6), Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) (All Versions), Modicon Momentum MDI (171CBU*) (Versions prior to V2.3), Legacy Modicon Quantum (All Versions)

The post CVE-2021-22786 appeared first on CVE Vulnerability.

]]> CVE-2021-22789 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22789/ Thu, 23 Feb 2023 14:07:23 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22789/ A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part […]

The post CVE-2021-22789 appeared first on CVE Vulnerability.

]]> A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).

The post CVE-2021-22789 appeared first on CVE Vulnerability.

]]> CVE-2021-22790 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22790/ Thu, 23 Feb 2023 14:07:23 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22790/ A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, […]

The post CVE-2021-22790 appeared first on CVE Vulnerability.

]]> A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).

The post CVE-2021-22790 appeared first on CVE Vulnerability.

]]> CVE-2021-22791 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22791/ Thu, 23 Feb 2023 14:07:23 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22791/ A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, […]

The post CVE-2021-22791 appeared first on CVE Vulnerability.

]]> A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).

The post CVE-2021-22791 appeared first on CVE Vulnerability.

]]> CVE-2022-45788 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-45788/ Thu, 23 Feb 2023 05:21:29 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-45788/ A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure™ Control Expert (All Versions), EcoStruxure™ Process Expert (Versions prior to V2020), Modicon M340 CPU – part […]

The post CVE-2022-45788 appeared first on CVE Vulnerability.

]]> A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure™ Control Expert (All Versions), EcoStruxure™ Process Expert (Versions prior to V2020), Modicon M340 CPU – part numbers BMXP34* (All Versions), Modicon M580 CPU – part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety – part numbers BMEP58*S and BMEH58*S (All Versions), Modicon Momentum Unity M1E Processor – 171CBU* (All Versions), Modicon MC80 – BMKC80 (All Versions), Legacy Modicon Quantum – 140CPU65* and Premium CPUs – TSXP57* (All Versions)

The post CVE-2022-45788 appeared first on CVE Vulnerability.

]]> CVE-2022-45789 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-45789/ Thu, 23 Feb 2023 05:21:29 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-45789/ A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure™ Control Expert (All Versions), EcoStruxure™ Process Expert (Versions prior to V2020), Modicon M340 CPU – part numbers BMXP34* (All Versions), Modicon M580 CPU – part numbers BMEP* […]

The post CVE-2022-45789 appeared first on CVE Vulnerability.

]]> A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure™ Control Expert (All Versions), EcoStruxure™ Process Expert (Versions prior to V2020), Modicon M340 CPU – part numbers BMXP34* (All Versions), Modicon M580 CPU – part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety – part numbers BMEP58*S and BMEH58*S (All Versions)

The post CVE-2022-45789 appeared first on CVE Vulnerability.

]]> CVE-2022-37300 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-37300/ Thu, 23 Feb 2023 05:20:02 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-37300/ A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of […]

The post CVE-2022-37300 appeared first on CVE Vulnerability.

]]> A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).

The post CVE-2022-37300 appeared first on CVE Vulnerability.

]]>