CVE:CVE-2021-22785
CNNVD:CNNVD-202202-1043
Schneider Electric Modicon Quantum等都是法国施耐德电气（Schneider Electric）公司的产品。Schneider Electric Modicon Quantum是一款用于过程应用、高可用性和安全解决方案的大型可编程逻辑控制器（PLC）。Schneider Electric Modicon M340是一款用于工业过程和基础设施的中程PLC（可编程逻辑控制器）。Schneider Electric Modicon Premium是一个应用于工业环境的可编程控制器。
Schneider Electric 多款产品存在安全漏洞，当攻击者向设备的 Web 服务器发送 HTTP 请求时，该漏洞可能导致位于 Web 根目录中的文件的敏感信息泄露。受影响的产品：Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)。
solution:Upgrade schneider-electric bmxp342020_firmware to a higher version than 3.40,and avoid the version (,3.40); Upgrade schneider-electric bmxnoe0100_firmware to a higher version than *; Upgrade schneider-electric bmxnoe0110_firmware to a higher version than *; Upgrade schneider-electric bmxnoc0401_firmware to a higher version than *; Upgrade schneider-electric bmxnor0200h_rtu_firmware to a higher version than *; Upgrade schneider-electric tsxp574634_firmware to a higher version than *; Upgrade schneider-electric tsxp575634_firmware to a higher version than *; Upgrade schneider-electric tsxp576634_firmware to a higher version than *; Upgrade schneider-electric 140cpu65150_firmware to a higher version than *; Upgrade schneider-electric 140noe771x1_firmware to a higher version than *; Upgrade schneider-electric 140noc78x00_firmware to a higher version than *; Upgrade schneider-electric 140noc77101_firmware to a higher version than *; Upgrade schneider-electric tsxety4103_firmware to a higher version than *; Upgrade schneider-electric tsxety5103_firmware to a higher version than *