description: A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34*)(V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*)(V3.22 and prior), Legacy Modicon Quantum/Premium(All Versions), Modicon Momentum MDI (171CBU*)(All Versions), Modicon MC80 (BMKC80)(V1.7 and prior)
problem types: CWE-191 Integer Underflow (Wrap or Wraparound)
affected:
{
vendor: Schneider Electric
product: Modicon M340 CPU (part numbers BMXP34*)
versions:
version: V, status: affected, lessThanOrEqual: 3.40, versionType: custom
}
{
vendor: Schneider Electric
product: Modicon M580 CPU (part numbers BMEP* and BMEH*)
versions:
version: V, status: affected, lessThanOrEqual: 3.22, versionType: custom
}
{
vendor: Schneider Electric
product: Legacy Modicon Quantum/Premium
versions:
version: All  Versions, status: affected
}
{
vendor: Schneider Electric
product: Modicon Momentum MDI (171CBU*)
versions:
version: All  Versions, status: affected
}
{
vendor: Schneider Electric
product: Modicon MC80 (BMKC80)
versions:
version: V, status: affected, lessThanOrEqual: 1.7, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
]