CVE-2022-34765 MEDIUM

CVE-2022-34765

Vendor Schneider Electric
Product OPC UA Modicon Communication Module
Weakness CWE-73
Published July 13, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is written to the file path. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior)

Key dates

02Disclosure timeline

July 13, 2022 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-35078 Arbitrary file delete vulnerability in method ugw-logstop CVE-2025-13320 WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter CVE-2026-5809 wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter CVE-2025-55316 Azure Connected Machine Agent Elevation of Privilege Vulnerability CVE-2024-9275 jeanmarc77 123solar admin_invt2.php file inclusion