Improper privilege management in Schneider Electric Modicon M340 CPUs
Priority MEDIUM 40CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24)
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0062 49th percentileScored 2026-11-07
Fix Fixed Modicon M340 CPUs (Schneider Electric): V3.40Modicon M340 X80 Ethernet Communication modules: BMXNOE0100 (H) BMXNOE0110 (H) BMXNOR0200H RTU (Schneider Electric): v1.7 IR24
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schneider Electric | Modicon M340 CPUs | before V3.40 | V3.40 | Patch available | CNA |
| Schneider Electric | Modicon M340 X80 Ethernet Communication modules: BMXNOE0100 (H) BMXNOE0110 (H) BMXNOR0200H RTU | all versions; before v1.7 IR24 | v1.7 IR24 | Patch available | CNA |
- Modicon M340 CPUs VendorSchneider Electric Affected before V3.40 Fixed in V3.40 Patch available CNA
- Modicon M340 X80 Ethernet Communication modules: BMXNOE0100 (H) BMXNOE0110 (H) BMXNOR0200H RTU VendorSchneider Electric Affected all versions; before v1.7 IR24 Fixed in v1.7 IR24 Patch available CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp341000_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp342000_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp342010_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp342010:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420102_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp341000_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp342000_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp342010_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp342010:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420102_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020h_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302h_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030h_firmware:*:*:*:*:*:*:*:* | before 3.50 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0100_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0110_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0110:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0110h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0110h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:modicon_m340_bmxnor0200h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:modicon_m340_bmxnor0200h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020h_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302h_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030h_firmware:*:*:*:*:*:*:*:* Versions before 3.50 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0100_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0110_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxnoe0110h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxnoe0110h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:modicon_m340_bmxnor0200h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:modicon_m340_bmxnor0200h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Remediation
- Fix · CNA Modicon M340 CPUs (Schneider Electric) Fixed in V3.40
- Fix · CNA Modicon M340 X80 Ethernet Communication modules: BMXNOE0100 (H) BMXNOE0110 (H) BMXNOR0200H RTU (Schneider Electric) Fixed in v1.7 IR24
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0222
- 2026-10-03 Alias added: GHSA-x99p-hp5r-mjx9
References
More Schneider Electric Modicon M340 Bmxnoe0100 Firmware vulnerabilities
- TI-2014-00703 Path traversal in Schneider Electric Ethernet modules for M340, Quantum and Premium PLC… CVSS 2.0CRITICAL 10.0
Sources
- CVE-2022-0222 · CVE Program
- CVE-2022-0222 · NVD
- FIRST EPSS
- GHSA-x99p-hp5r-mjx9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences