What’s Vulnerable › Vulnerabilities
CVE-2022-45788
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-01-30 · updated 2026-06-17
- Weakness: CWE-754
Description
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions), Modicon Momentum Unity M1E Processor - 171CBU* (All Versions), Modicon MC80 - BMKC80 (All Versions), Legacy Modicon Quantum - 140CPU65* and Premium CPUs - TSXP57* (All Versions)
Affected products
- Schneider Electric EcoStruxure Control Expert: all versions
- Schneider Electric EcoStruxure Process Expert: before 2021 — fixed in 2021
- Schneider-Electric Modicon M340 Bmxp341000 Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp342000 Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp3420102 Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp342010 Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp342020 Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp342020H Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp3420302 Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp3420302H Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp342030 Firmware: all versions
- Schneider-Electric Modicon M340 Bmxp342030H Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh582040 Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh582040C Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh582040S Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh584040 Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh584040C Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh584040S Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh586040 Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh586040C Firmware: all versions
- Schneider-Electric Modicon M580 Bmeh586040S Firmware: all versions
- Schneider-Electric Modicon M580 Bmep581020 Firmware: all versions
- Schneider-Electric Modicon M580 Bmep581020H Firmware: all versions
- Schneider-Electric Modicon M580 Bmep582020 Firmware: all versions
- Schneider-Electric Modicon M580 Bmep582020H Firmware: all versions
- Schneider-Electric Modicon M580 Bmep582040 Firmware: all versions
- Schneider-Electric Modicon M580 Bmep582040H Firmware: all versions
- Schneider-Electric Modicon M580 Bmep582040S Firmware: all versions
- Schneider-Electric Modicon M580 Bmep583020 Firmware: all versions
- Schneider-Electric Modicon M580 Bmep583040 Firmware: all versions
How to fix
Upgrade to a fixed version: Schneider Electric EcoStruxure Process Expert 2021. Check the vendor advisory for mitigations.
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf
Get alerted when CVE-2022-45788 or the next vulnerability affects your stack