CVE-2021-22749

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-11 · updated 2026-06-17
Weakness: CWE-200

Description

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could cause information leak concerning the current RTU configuration including communication parameters dedicated to telemetry, when a specially crafted HTTP request is sent to the web server of the module.

Affected products

Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior: sv1.6-ir4, sv1.7-ir10, sv1.7-ir15b, sv1.7-ir17, sv1.7-ir18, sv1.7-ir19 (+1)

References

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05

Get alerted when CVE-2021-22749 or the next vulnerability affects your stack