Skip to main content

Opc Ua Module For M580 Firmware CVE-2022-34763

HIGH
Insufficient Verification of Data Authenticity (CWE-345)
2022-07-13 cybersecurity@se.com
Authentication Bypass Opc Ua Module For M580 Firmware X80 Advanced Rtu Module Firmware
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 13, 2022 - 21:15 nvd
HIGH 7.5

DescriptionNVD

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

AnalysisAI

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-345. A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Affected products include: Schneider-Electric Opc Ua Module For M580 Firmware, Schneider-Electric X80 Advanced Rtu Module Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Opc Ua Module For M580 Firmware

View all
CVE-2022-34764 HIGH
7.5 Jul 13

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause
CVE-2022-34762 HIGH
7.5 Jul 13

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could
CVE-2022-34761 HIGH
7.5 Jul 13

A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when pars
CVE-2022-34760 HIGH
7.5 Jul 13

A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of serv
CVE-2022-34759 HIGH
7.5 Jul 13

A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to imprope
CVE-2022-34765 MEDIUM
5.3 Jul 13

A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware i

Same weakness CWE-345 – Insufficient Verification of Data Authenticity

View all
CVE-2016-4553 HIGH
8.6
CVE-2016-4554 HIGH
8.6
CVE-2014-4936 CRITICAL POC
9.3
CVE-2023-38831 HIGH POC
7.8
CVE-2025-66255 CRITICAL POC
9.9
CVE-2025-1945 CRITICAL POC
9.8
CVE-2024-11666 CRITICAL POC
9.8
CVE-2024-1554 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2022-34763 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy