Improper input validation in Modicon M340 CPUs: BMXP34 , Modicon M340 X80 Ethernet…
Priority MEDIUM 41CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01066 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions) | Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions) | — | No fix listed | CNA |
- Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions) Vendor— Affected Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions) Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware:*:*:*:*:*:*:*:* | before 3.40 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:bmxnoe0100_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:bmxnoe0100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:bmxnoe0110_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:bmxnoe0110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:bmxnoc0401_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:bmxnoc0401:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:bmxnor0200h_rtu_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:bmxnor0200h_rtu:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware:*:*:*:*:*:*:*:* Versions before 3.40 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:bmxnoe0100_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:bmxnoe0100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:bmxnoe0110_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:bmxnoe0110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:bmxnoc0401_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:bmxnoc0401:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:bmxnor0200h_rtu_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:bmxnor0200h_rtu:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:tsxp574634_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp574634:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp575634_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp575634:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp576634_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp576634:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu65150_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu65150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140noe771x1_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140noe771x1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140noc78x00_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140noc78x00:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140noc77101_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140noc77101:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxety4103_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxety4103:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxety5103_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxety5103:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:tsxp574634_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp574634:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp575634_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp575634:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp576634_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp576634:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu65150_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu65150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140noe771x1_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140noe771x1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140noc78x00_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140noc78x00:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140noc77101_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140noc77101:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxety4103_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxety4103:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxety5103_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxety5103:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22787
- 2026-10-03 Alias added: GHSA-6hhq-23pq-rm6g
More Schneider Electric 140cpu65150 Firmware vulnerabilities
- TI-2018-05250 Hard-coded credentials in Schneider Electric Modicon Premium, Modicon Quantum, Modicon… CVSS 3.0CRITICAL 9.8
- TI-2020-06063 Missing authentication in Web Server on Modicon M340, Legacy Offers Modicon Quantum and… CVSS 3.1CRITICAL 9.8
- TI-2018-05604 Improper input validation in Schneider Electric Modicon M340, Modicon Premium, Modicon… CVSS 3.0CRITICAL 9.8
- TI-2018-05251 Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon… CVSS 3.0CRITICAL 9.8
- TI-2018-05603 Improper authentication in Schneider Electric Modicon M340, Modicon Premium, Modicon… CVSS 3.0CRITICAL 9.8
- TI-2018-05249 Out-of-bounds write in Schneider Electric Modicon Quantum CVSS 3.0HIGH 8.8
Sources
- CVE-2021-22787 · CVE Program
- CVE-2021-22787 · NVD
- FIRST EPSS
- GHSA-6hhq-23pq-rm6g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences