A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service when parsing the URL. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service when parsing the URL. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

Schneider Electric is aware of multiple vulnerabilities in its BMENUA0100 - OPC UA module and BMENOR2200H X80 advanced RTU communication module for M580. The BMENUA0100 - OPC UA module for M580 is an Ethernet communications module with an embedded OPC UA server for communication with OPC UA clients, including SCADA. The BMENOR2200H – X80 advanced RTU module is an Ethernet communication module that enables M580 platform to use RTU protocol exchange with RTU stations. Failure to apply the mitigations provided below may introduce risks including denial of service of the webserver and bypass of the secure boot process, which could result in running an unauthorized firmware.