CVE-2021-22699

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-26 · updated 2026-06-17
Weakness: CWE-20

Description

Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specific crafted requests are sent to the controller over HTTP.

Affected products

Schneider-Electric Modicon M241 Firmware: before 5.1.9.1 — fixed in 5.1.9.1
Schneider-Electric Modicon M251 Firmware: before 5.1.9.1 — fixed in 5.1.9.1

How to fix

Upgrade to a fixed version: Schneider-Electric Modicon M241 Firmware 5.1.9.1; Schneider-Electric Modicon M251 Firmware 5.1.9.1. Check the vendor advisory for mitigations.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-05
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-130-05

Get alerted when CVE-2021-22699 or the next vulnerability affects your stack