What’s Vulnerable › Vulnerabilities

CVE-2022-0222

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-22 · updated 2026-06-17
• Weakness: CWE-269

Description

A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24)

Affected products

• Schneider-Electric Modicon M340 Bmxnoe0100 Firmware: all versions
• Schneider-Electric Modicon M340 Bmxnoe0110 Firmware: all versions
• Schneider-Electric Modicon M340 Bmxnoe0110H Firmware: all versions
• Schneider-Electric Modicon M340 Bmxnor0200H Firmware: all versions
• Schneider-Electric Modicon M340 Bmxp341000 Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp342000 Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp3420102 Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp342010 Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp342020 Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp342020H Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp3420302 Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp3420302H Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp342030 Firmware: before 3.50 — fixed in 3.50
• Schneider-Electric Modicon M340 Bmxp342030H Firmware: before 3.50 — fixed in 3.50

How to fix

Upgrade to a fixed version: Schneider-Electric Modicon M340 Bmxp341000 Firmware 3.50; Schneider-Electric Modicon M340 Bmxp342000 Firmware 3.50; Schneider-Electric Modicon M340 Bmxp3420102 Firmware 3.50; Schneider-Electric Modicon M340 Bmxp342010 Firmware 3.50; Schneider-Electric Modicon M340 Bmxp342020 Firmware 3.50; Schneider-Electric Modicon M340 Bmxp342020H Firmware 3.50; Schneider-Electric Modicon M340 Bmxp3420302 Firmware 3.50; Schneider-Electric Modicon M340 Bmxp3420302H Firmware 3.50; Schneider-Electric Modicon M340 Bmxp342030 Firmware 3.50; Schneider-Electric Modicon M340 Bmxp342030H Firmware 3.50. Check the vendor advisory for mitigations.

References

• https://www.se.com/us/en/download/document/SEVD-2022-102-02/
• https://www.se.com/us/en/download/document/SEVD-2022-102-02/

Get alerted when CVE-2022-0222 or the next vulnerability affects your stack