CyberSecBulletin
CVE-2022-37300NVD status: Modified

EcoStruxure Control Expert: Weak Password Recovery Mechanism for Forgotten Password

Published Updated By the CyberSecBulletin desk

CVE-2022-37300 is a critical-severity weak password recovery mechanism for forgotten password vulnerability in EcoStruxure Control Expert from Schneider Electric, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected EcoStruxure Control Expert versions: SP1 through 15.0. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.78% chance of exploitation within 30 days, higher than 57% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Modicon M340 Bmxp341000 Firmware to 3.50 or a later version.
  2. Update Modicon M340 Bmxp342000 Firmware to 3.50 or a later version.
  3. Update Modicon M340 Bmxp342010 Firmware to 3.50 or a later version.
  4. Read the advisory on se.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Schneider ElectricEcoStruxure Control ExpertSP1 through 15.0Not stated
Schneider ElectricEcoStruxure Process ExpertV through 2021Not stated
Schneider ElectricModicon M340 CPUBMXP34 through 3.40Not stated
Schneider ElectricModicon M580 CPUBMEP through 3.20; BMEH through 3.20Not stated
Schneider ElectricModicon M340 Bmxp341000 Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp342000 Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp342010 Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp3420102 Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp342020 Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp342020h Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp342030 Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp3420302 Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp3420302h Firmwarebefore 3.503.50
Schneider ElectricModicon M340 Bmxp342030h Firmwarebefore 3.503.50
Schneider ElectricModicon M580 Bmeh582040 Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmeh582040c Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmeh582040s Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmeh584040 Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmeh584040c Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmeh584040s Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmeh586040 Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmeh586040c Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmeh586040s Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmep581020 Firmwarebefore 4.024.02
Schneider ElectricModicon M580 Bmep581020h Firmwarebefore 4.024.02

Version data comes from the organisation that assigned the CVE; 13 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.19.8CriticalCNA (se.com)
CVSS 3.19.8CriticalNVD

Official description

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

How developers prevent this class of flaw

  • Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
  • Do not use standard weak security questions and use several security questions.
  • Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.

More Weak Password Recovery Mechanism for Forgotten Password vulnerabilities (CWE-640)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in EcoStruxure Control Expert

All EcoStruxure Control Expert vulnerabilities

Recent Weak Password Recovery Mechanism for Forgotten Password vulnerabilities

Spotted an error? Tell us.