Schneider Electric Modicon m218 Firmware vulnerabilities

5 CVEs affecting Schneider Electric Modicon m218 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22800, published 2022-02-11.

More from Schneider Electric.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-7502, published 2020-06-16. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A CWE-787: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (Firmware version 4.3 and prior), which may cause a Denial of Service when specific TCP/IP crafted packets are…
• CVE-2020-7524, published 2020-08-31. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial of Service when sending specific crafted IPV4 packet to the controller: Sending…
• CVE-2021-22800, published 2022-02-11. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A CWE-20: Improper Input Validation vulnerability exists that could cause a Denial of Service when a crafted packet is sent to the controller over network port 1105/TCP. Affected Product: Modicon…
• CVE-2020-7488, published 2020-04-22. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258…
• CVE-2020-7487, published 2020-04-22. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers.