CVE-2021-22749

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-22749
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could cause information leak concerning the current RTU configuration including communication parameters dedicated to telemetry, when a specially crafted HTTP request is sent to the web server of the module.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05 Vendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.6:ir4:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir10:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir15b:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir17:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir18:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir19:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir20:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:modicon_x80_bmxnor0200h_rtu:-:*:*:*:*:*:*:*
History

21 Nov 2024, 05:50

Type Values Removed Values Added
References () http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05 - Vendor Advisory () http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05 - Vendor Advisory

22 Jun 2021, 19:02

Type Values Removed Values Added
CWE CWE-200
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 5.3
CPE cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir17:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir10:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir20:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:modicon_x80_bmxnor0200h_rtu:-:*:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir19:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir18:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.7:ir15b:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_x80_bmxnor0200h_rtu_firmware:sv1.6:ir4:*:*:*:*:*:*
References (MISC) http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05 - (MISC) http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05 - Vendor Advisory

11 Jun 2021, 17:18

Type Values Removed Values Added
New CVE
Information

Published : 2021-06-11 16:15

Updated : 2024-11-21 05:50

NVD link : CVE-2021-22749

Mitre link : CVE-2021-22749

CVE.ORG link : CVE-2021-22749

JSON object : View

Products Affected

schneider-electric

  • modicon_x80_bmxnor0200h_rtu
  • modicon_x80_bmxnor0200h_rtu_firmware
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor