CVE-2022-45789

published 2023-01-31

CVE-2022-45789: A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)

Affected

6 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	ecostruxure_process_expert	<= 2020	—
schneider_electric	ecostruxure_control_expert	—	—
schneider_electric	ecostruxure_process_expert	—	—
schneider_electric	modicon_m340_cpu	—	—
schneider_electric	modicon_m580_cpu	—	—
schneider_electric	modicon_m580_cpu_safety	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 502/TCP↗

• → Monitor for unauthorized or replayed Modbus function codes on TCP/502 sessions — the attack hijacks an already-authenticated Modbus session via capture-replay to execute arbitrary Modbus functions on the controller. ↗
• → Alert on Modbus traffic (TCP/502) originating from hosts that are not the designated engineering workstation or known authorized clients, as the attacker replays captured authenticated sessions from a third-party network position. ↗
• → Detect duplicate or out-of-sequence Modbus session tokens/transaction IDs on TCP/502, which may indicate a capture-replay attack replaying a previously observed authenticated exchange. ↗

• · EcoStruxure Process Expert V2021 is the only software release confirmed not impacted, as the vulnerable component was removed; all earlier versions remain exposed. ↗
• · Attack complexity is rated HIGH (AC:H in CVSS vector), meaning exploitation requires the attacker to first capture a legitimate authenticated Modbus session before replaying it. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-294