{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "RIOT OS version 2020.01.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments SimpleLink-CC32XX versions ant\u00e9rieures \u00e0 4.10.03",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Media Tek LinkIt SDK versions ant\u00e9rieures \u00e0 4.6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "NXP MCUXpresso SDK versions ant\u00e9rieures \u00e0 2.8.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments SimpleLink MSP432E4XX",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Windriver VxWorks versions ant\u00e9rieures \u00e0 7.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Micrium OS, versions ant\u00e9rieures \u00e0 5.10.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments SimpleLink-CC13XX versions ant\u00e9rieures \u00e0 4.40.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ARM CMSIS-RTOS2 versions ant\u00e9rieures \u00e0 2.1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Micrium uC/OS: uC/LIB versions ant\u00e9rieures \u00e0 1.39.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments SimpleLink-CC26XX versions ant\u00e9rieures \u00e0 4.40.00",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "NXP MQX versions ant\u00e9rieures \u00e0 5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ARM Mbed OS version 6.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "TencentOS-tiny, version 3.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Texas Instruments CC32XX versions ant\u00e9rieures \u00e0 4.40.00.07",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Redhat newlib versions ant\u00e9rieures \u00e0 4.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BlackBerry QNX SDP versions ant\u00e9rieures \u00e0 6.5.0SP1 sans le dernier correctif",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BlackBerry QNX OS for Safety versions ant\u00e9rieures \u00e0 1.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ARM mbed-ualloc version 1.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Nuttx OS version 9.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Uclibc-NG versions ant\u00e9rieures \u00e0 1.0.36",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Amazon FreeRTOS version 10.4.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "BlackBerry QNX OS for Medical versions ant\u00e9rieures \u00e0 1.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Linux Zephyr RTOS versions ant\u00e9rieures \u00e0 2.5.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Zephyr Project RTOS versions ant\u00e9rieures \u00e0 2.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "eCosCentric eCosPro RTOS versions 2.0.1 \u00e0 4.5.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Samsung Tizen RT RTOS versions ant\u00e9rieures \u00e0 3.0.GBB",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Cesanta Software Mongoose OS version 2.17.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Google Cloud IoT Device SDK version 1.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Google",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\n-   Les int\u00e9grateurs de ces RTOS sont invit\u00e9s \u00e0 prendre contact\n    rapidement avec l\u2019\u00e9diteur du produit affect\u00e9 afin de corriger leurs\n    propres solutions et diffuser le correctif\u00a0;\n-   Les utilisateurs d\u2019\u00e9quipements bas\u00e9s sur ces RTOS sont invit\u00e9s \u00e0\n    prendre contact avec le fournisseur afin de mettre \u00e0 jour les\n    \u00e9quipements affect\u00e9s\u00a0;\n-   Il convient en outre d\u2019appliquer les bonnes pratiques r\u00e9f\u00e9renc\u00e9es\n    dans le guide ANSSI \\[1\\] et notamment celles ci-apr\u00e8s.\n    -   S\u2019assurer que les appareils concern\u00e9s ne sont pas accessibles\n        depuis Internet.\n    -   S\u2019assurer que les syst\u00e8mes ne se connectent qu\u0027\u00e0 des r\u00e9seaux ou\n        sous-r\u00e9seaux isol\u00e9s de confiance. Adopter une d\u00e9marche de\n        d\u00e9fense en profondeur permet de se prot\u00e9ger contre des menaces\n        qui ne sont pas encore connues, de diminuer le p\u00e9rim\u00e8tre sur\n        lequel une menace est exerc\u00e9e ou d\u2019en att\u00e9nuer l\u2019impact. Le\n        simple cloisonnement des r\u00e9seaux par des pare-feux ne suffit\n        pas. D\u2019autres m\u00e9canismes doivent l\u2019accompagner et \u00e0 diff\u00e9rents\n        niveaux (contr\u00f4le d\u2019acc\u00e8s physique, durcissement des\n        configurations, protection antivirale...).\n    -   Inclure des m\u00e9canismes de d\u00e9tection et de surveillance des\n        installations. Surveiller de fa\u00e7on permanente les appareils \u00e0 la\n        recherche de comportements anormaux ou non autoris\u00e9s tels que la\n        communication avec des h\u00f4tes locaux ou distants inconnus. Enfin\n        la collecte des informations au travers des journaux d\u2019alarmes\n        et d\u2019\u00e9v\u00e9nements est indispensable aux analyses ult\u00e9rieures. Ces\n        journaux pourront dans certains cas apporter des \u00e9l\u00e9ments utiles\n        et des preuves dans le cadre d\u2019une enqu\u00eate judiciaire.\n    -   R\u00e9duire la surface d\u0027attaque en \u00e9liminant les services sans\n        utilit\u00e9 fonctionnelle ou non s\u00e9curis\u00e9s.\n\n\\[1\\] Guide de l\u0027ANSSI sur la s\u00e9curit\u00e9 industrielle :\n\u003chttps://www.ssi.gouv.fr/uploads/IMG/pdf/Guide_securite_industrielle_Version_finale.pdf\u003e\n",
  "cves": [
    {
      "name": "CVE-2021-27502",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27502"
    },
    {
      "name": "CVE-2021-27504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27504"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2021-31572",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31572"
    },
    {
      "name": "CVE-2021-22684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22684"
    },
    {
      "name": "CVE-2021-22680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22680"
    },
    {
      "name": "CVE-2021-26461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-26461"
    },
    {
      "name": "CVE-2021-27431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27431"
    },
    {
      "name": "CVE-2021-31571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31571"
    },
    {
      "name": "CVE-2021-22156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22156"
    },
    {
      "name": "CVE-2021-26706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-26706"
    },
    {
      "name": "CVE-2021-27419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27419"
    },
    {
      "name": "CVE-2021-22636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22636"
    },
    {
      "name": "CVE-2021-27429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27429"
    },
    {
      "name": "CVE-2021-27433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27433"
    },
    {
      "name": "CVE-2021-27421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27421"
    },
    {
      "name": "CVE-2021-27425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27425"
    },
    {
      "name": "CVE-2021-27417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27417"
    },
    {
      "name": "CVE-2021-3420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3420"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2021-27427",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27427"
    },
    {
      "name": "CVE-2021-27439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27439"
    },
    {
      "name": "CVE-2020-13603",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13603"
    },
    {
      "name": "CVE-2021-30636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-30636"
    },
    {
      "name": "CVE-2021-27435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27435"
    },
    {
      "name": "CVE-2021-27411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27411"
    }
  ],
  "initial_release_date": "2021-08-18T00:00:00",
  "last_revision_date": "2021-08-18T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 BadAlloc icsa-21-119-04 du 20 mai 2021, mis \u00e0 jour le 17 ao\u00fbt 2021",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-119-04"
    }
  ],
  "reference": "CERTFR-2021-AVI-639",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-08-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les syst\u00e8mes\nd\u0027exploitation temps r\u00e9el (*RTOS, Real Time OS*). Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un\nd\u00e9ni de service \u00e0 distance.\n\nCette famille de vuln\u00e9rabilit\u00e9s dans les *RTOS* a \u00e9t\u00e9 d\u00e9couverte,\nd\u00e9crite puis nomm\u00e9e \u00ab\u00a0BadAlloc\u00a0\u00bb par Microsoft, appellation donn\u00e9e en\nraison de l\u2019absence de v\u00e9rification des entr\u00e9es dans l\u2019allocateur\nm\u00e9moire de tas. Ces vuln\u00e9rabilit\u00e9s d\u0027ex\u00e9cution de code \u00e0 distance (RCE)\nsont r\u00e9f\u00e9renc\u00e9es par 26 CVEs et affectent potentiellement un large\n\u00e9ventail de domaines, de l\u0027IoT grand public et m\u00e9dical \u00e0 l\u0027IoT\nindustriel, aux technologies op\u00e9rationnelles (OT) et aux syst\u00e8mes de\ncontr\u00f4le industriel. Une dizaine d\u2019\u00e9diteurs sont concern\u00e9s.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans des syst\u00e8mes d\u0027exploitation temps r\u00e9el",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat newlib du 17 novembre 2020",
      "url": "https://sourceware.org/git/?p=newlib-cygwin.git;a=commit;h=aa106b29a6a8a1b0df9e334704292cbc32f2d44e"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ARM CMSIS RTOS2 du 24 juin 2021",
      "url": "https://www.keil.com/pack/doc/CMSIS/RTOS2/html/rtos_revisionHistory.html"
    },
    {
      "published_at": null,
      "title": "\ufeffBulletin de s\u00e9curit\u00e9 BadAlloc icsa-21-119-04 du 20 mai 2021",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 ARM mbed du 22 mars 2021",
      "url": "https://github.com/ARMmbed/mbed-os/pull/14408"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Zephyr Project RTOS du 23 mars 2021",
      "url": "https://github.com/zephyrproject-rtos/zephyr/pull/31796"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Wind River VxWorks 20210319 du 19 mars 2021",
      "url": "https://support2.windriver.com/index.php?page=security-notices\u0026on=view\u0026id=7048"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Wind River VxWorks 20210203 du 03 f\u00e9vrier 2021",
      "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2020-28895"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 eCosCentric eCosPro RTOS 1002437 du 16 ao\u00fbt 2021",
      "url": "https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 FreeRTOS du 07 d\u00e9cembre 2020",
      "url": "https://github.com/FreeRTOS/FreeRTOS-Kernel/pull/224"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 BlackBerry du 17 ao\u00fbt 2021",
      "url": "https://support.blackberry.com/kb/articleDetail?articleNumber=000082334\u0026language=en_US"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Nuttx OS du 21 juin 2021",
      "url": "https://lists.apache.org/thread.html/r806fccf8b003ae812d807c6c7d97950d44ed29b2713418cbe3f2bddd%40%3Cdev.nuttx.apache.org%3E"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Texas Instruments TI-PSIRT-2020-100074 du 29 avril 2021",
      "url": "https://www.ti.com/lit/an/swra709/swra709.pdf?ts=1629129702198"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Google Cloud IoT Device du 12 avril 2021",
      "url": "https://github.com/GoogleCloudPlatform/iot-device-sdk-embedded-c/pull/119/files"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Momentum MDI (171CBU*), MC80 (BMKC8*), HART (BMEAH*) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "versadac, toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "EPack toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EPC2000 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon M262 Logic Controllers firmware version 5.1.5.35 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "SCD6000 Industrial RTU Version ant\u00e9rieures \u00e0 SCD6000 is SY-1101211_Mand",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "SCADAPack 312E, 313E, 314E, 330E, 333E, 334E, 337E, 350E et 357E RTUs avec le firmware V8.18.1 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "NMC embedded devices",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMENOC0321, BMENOC0301, BMENOC0311, BMENOS0300 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMECRA31210, BMXCRA31200, BMXCRA31210, 140CRA31200, 140CRA31908 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon M241/M251 Logic Controllers firmware version 5.1.9.21 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Process Expert versions ant\u00e9rieures \u00e0 V2021",
      "product": {
        "name": "process",
        "vendor": {
          "name": "Symfony",
          "scada": false
        }
      }
    },
    {
      "description": "Tricon Communication Modules versions ant\u00e9rieures \u00e0 11.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "TelevisAir V3.0 Dongle BTLE (part number ADBT42* et ant\u00e9rieures)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon M580 CPU (BMEP* and BMEH*), Modicon M340 CPU (BMXP34*), BMXNOM0200 toutes versions",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Easy Harmony GXU (HMIGXU Series) et Easy Harmony ET6 (HMIET Series) Vijeo Designer Basic V1.2 family et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "T2750 PAC, toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "HMISTO Series HMISTU/S5T Series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "TCSEGPA23F14F, BMECXM0100 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "HMISCU,HMIGTU, HMIG2U, HMIG3U, HMIG3X, HMIGTO Series Vijeo Designer (V6.2 SP11) family et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMXNOE0100, BMXNOE0110, BMXNGD0100, BMXNOC0401 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Pro-face GP4100 Series, GP4000E Series, GP4000M Series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Pro-face SP-5B00, SP-5B10, SP-5B90, ST6000 Series (GP-ProEX model), ET6000 Series GP-Pro EX V4.09.300 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Momentum ENT (170ENT11*) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "nanodac toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Network Management Card 2 (NMC2)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Schneider Electric Software Update, V2.3.0 \u00e0 V2.5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Network Management Card 3 (NMC3)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "6100A, 6180A, 6100XIO, 6180XIO, AeroDAQ toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMXNOM0200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "BMENOP0300, BMXNOR0200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon LMC078 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "E+PLC400 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Pro-face GP4000 Series, LT4000M Series, GP4000H Series GP-Pro EX V4.09.300 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22808",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22808"
    },
    {
      "name": "CVE-2021-34527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34527"
    },
    {
      "name": "CVE-2021-22811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22811"
    },
    {
      "name": "CVE-2021-22813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22813"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2021-22807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22807"
    },
    {
      "name": "CVE-2021-22810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22810"
    },
    {
      "name": "CVE-2021-22815",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22815"
    },
    {
      "name": "CVE-2021-1675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1675"
    },
    {
      "name": "CVE-2021-22812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22812"
    },
    {
      "name": "CVE-2021-22809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22809"
    },
    {
      "name": "CVE-2021-22814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22814"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2021-22799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22799"
    },
    {
      "name": "CVE-2021-22816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22816"
    }
  ],
  "initial_release_date": "2021-11-09T00:00:00",
  "last_revision_date": "2021-11-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-853",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-11-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-07 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-01 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-06 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-06"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-04 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-02 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-02"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-03 du 9 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-03"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SCD6000 Industrial RTU version SCD6000 SY11012 11_M et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon BMENOC 0311",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "EVlink City (EVC1S22P4 / EVC1S7P4), EVlink Parking (EVW2 / EVF2 / EVP2PE), EVlink Smart Wallbox EVB1A toutes versions ant\u00e9rieures \u00e0 R8 V3.4.0.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon BMENOC 0321",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon M580",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "EcoStruxure\u2122 Power Monitoring Expert versions V9.0 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "IGSS Data Collector (dc.exe) version 15.0.0.21320 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "APDU9xxx with NMC3 version V1.0.0.28 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "AP7xxxx and AP8xxx with NMC2 version V6.9.6 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "AP7xxx and AP8xxx with NMC3 version V1.1.0.3 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2021-22725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22725"
    },
    {
      "name": "CVE-2019-6848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6848"
    },
    {
      "name": "CVE-2021-22156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22156"
    },
    {
      "name": "CVE-2021-22823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22823"
    },
    {
      "name": "CVE-2021-22818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22818"
    },
    {
      "name": "CVE-2021-22820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22820"
    },
    {
      "name": "CVE-2021-22821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22821"
    },
    {
      "name": "CVE-2021-22824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22824"
    },
    {
      "name": "CVE-2021-22822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22822"
    },
    {
      "name": "CVE-2019-6849",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6849"
    },
    {
      "name": "CVE-2021-22825",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22825"
    },
    {
      "name": "CVE-2021-44228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
    },
    {
      "name": "CVE-2021-22724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22724"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2021-22826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22826"
    },
    {
      "name": "CVE-2019-6850",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6850"
    },
    {
      "name": "CVE-2021-22827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22827"
    },
    {
      "name": "CVE-2021-22819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22819"
    }
  ],
  "initial_release_date": "2021-12-15T00:00:00",
  "last_revision_date": "2021-12-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-953",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-12-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-348-02 du 14 d\u00e9cembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-348-01 du 14 d\u00e9cembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SSEVD-2021-348-03 du 14 d\u00e9cembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-03"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2019-281-04 du 14 d\u00e9cembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-281-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-348-04 du 14 d\u00e9cembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 14 d\u00e9cembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NetBotz 4 - 355/450/455/550/570 versions ant\u00e9rieures \u00e0 4.7.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ISaGRAF versions ant\u00e9rieures \u00e0 6.6.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "EPC2000 versions ant\u00e9rieures \u00e0 4.03",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-43378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43378"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2022-43377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43377"
    },
    {
      "name": "CVE-2022-43376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43376"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    }
  ],
  "initial_release_date": "2022-11-08T00:00:00",
  "last_revision_date": "2022-11-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-1000",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-11-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Elles permettent \u00e0 un attaquant de provoquer un contournement\nde la politique de s\u00e9curit\u00e9 et une injection de code indirecte \u00e0\ndistance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-312-01 du 8 novembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-312-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-312-01-NetBotz_4_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-159-04 du 8 novembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-159-04_ISaGRAF_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 8 novembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Modicon M580 CPU Safety (BMEP58*S et BMEH58*S) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "APC Easy UPS Online Monitoring versions ant\u00e9rieures \u00e0 2.5-GA-01-22320",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "EcoStruxure Power Commission versions ant\u00e9rieures \u00e0 2.26",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "SAITEL DR RTU Baseline 11.06.x ant\u00e9rieures \u00e0 1.06.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-6846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6846"
    },
    {
      "name": "CVE-2022-42971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42971"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2021-22791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22791"
    },
    {
      "name": "CVE-2022-42973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42973"
    },
    {
      "name": "CVE-2019-6841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6841"
    },
    {
      "name": "CVE-2021-22779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22779"
    },
    {
      "name": "CVE-2021-22790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22790"
    },
    {
      "name": "CVE-2022-37301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37301"
    },
    {
      "name": "CVE-2018-7241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7241"
    },
    {
      "name": "CVE-2021-22786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22786"
    },
    {
      "name": "CVE-2018-7242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7242"
    },
    {
      "name": "CVE-2019-6844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6844"
    },
    {
      "name": "CVE-2019-6842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6842"
    },
    {
      "name": "CVE-2020-6996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-6996"
    },
    {
      "name": "CVE-2022-37300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37300"
    },
    {
      "name": "CVE-2021-22789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22789"
    },
    {
      "name": "CVE-2019-6847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6847"
    },
    {
      "name": "CVE-2021-22792",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22792"
    },
    {
      "name": "CVE-2022-42970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42970"
    },
    {
      "name": "CVE-2019-6843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6843"
    },
    {
      "name": "CVE-2018-7240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7240"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2022-4062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4062"
    },
    {
      "name": "CVE-2022-42972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42972"
    }
  ],
  "initial_release_date": "2022-12-13T00:00:00",
  "last_revision_date": "2022-12-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-1093",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-12-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider du 13 d\u00e9cembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-347-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-347-01-APC_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eIGSS Data Server versions ant\u00e9rieures \u00e0 V15.0.0.22021\u003cbr /\u003e EcoStruxure EV Charging Expert versions ant\u00e9rieures \u00e0 V4.0.0.13 SP8 (Version 01)\u003cbr /\u003e Easergy P40 Series model numbers avec option Ethernet (produit ayant le code Q, R, S)\u003cbr /\u003e spaceLYnk versions ant\u00e9rieures \u00e0 2.7.0\u003cbr /\u003e Wiser for KNX product versions ant\u00e9rieures \u00e0 2.7.0\u003cbr /\u003e fellerLYnk product versions ant\u00e9rieures \u00e0 2.7.0\u003cbr /\u003e EcoStruxure Geo SCADA Expert versions ant\u00e9rieures \u00e0 2021\u003cbr /\u003e ClearSCADA versions ant\u00e9rieures \u00e0 2017 R3 August 2021 Monthly Update.\u003cbr /\u003e Harmony/Magelis iPC Series sans le correctif fourni avec Vijeo Designer version V6.2 SP11 Multi HotFix 4\u003cbr /\u003e Vijeo Designer versions ant\u00e9rieures \u00e0 V6.2 SP11 Multi HotFix 4\u003cbr /\u003e Vijeo Designer Basic versions ant\u00e9rieures \u00e0 v1.2.1\u003cbr /\u003e M241/M251 toutes versions\u003cbr /\u003e EcoStruxure Machine Expert toutes versions\u003cbr /\u003e Harmony/Magelis mod\u00e8les HMISTU, HMIGTO, HMIGTU, HMIGTUX, HMIGK, HMISCU\u003cbr /\u003e Eurotherm E+PLC100 toutes versions\u003cbr /\u003e Eurotherm E+PLC400 toutes versions\u003cbr /\u003e Eurotherm E+PLC tools toutes versions\u003cbr /\u003e Easy Harmony ET6 (HMIET) sans le correctif fourni avec Vijeo Designer Basic version V1.2.1\u003cbr /\u003e Easy Harmony GXU (HMIGXU) sans le correctif fourni avec Vijeo Designer Basic version V1.2.1\u003cbr /\u003e Harmony/ Magelis mod\u00e8les HMIGTU, HMIGTUX, HMIGK sans le correctif fourni avec Vijeo Designer version V6.2 SP11 Multi HotFix 4\u003cbr /\u003e Modicon M241/M251 Logic Controllers versions ant\u00e9rieures \u00e0 V5.1.9.34\u003cbr /\u003e Modicon M262 Logic Controllers versions ant\u00e9rieures \u00e0 V5.1.6.1\u003cbr /\u003e Easergy MiCOM P30 versions 660 -674\u003cbr /\u003e Easergy MiCOM P40 toutes versions\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22817"
    },
    {
      "name": "CVE-2022-22812",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22812"
    },
    {
      "name": "CVE-2022-24312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24312"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2022-24316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24316"
    },
    {
      "name": "CVE-2022-24314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24314"
    },
    {
      "name": "CVE-2022-24320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24320"
    },
    {
      "name": "CVE-2022-22811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22811"
    },
    {
      "name": "CVE-2022-24321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24321"
    },
    {
      "name": "CVE-2022-22810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22810"
    },
    {
      "name": "CVE-2022-24310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24310"
    },
    {
      "name": "CVE-2022-24311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24311"
    },
    {
      "name": "CVE-2022-24318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24318"
    },
    {
      "name": "CVE-2022-22813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22813"
    },
    {
      "name": "CVE-2022-24313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24313"
    },
    {
      "name": "CVE-2022-24319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24319"
    },
    {
      "name": "CVE-2022-24315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24315"
    },
    {
      "name": "CVE-2022-22809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22809"
    },
    {
      "name": "CVE-2022-22808",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22808"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2022-24317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24317"
    },
    {
      "name": "CVE-2021-29240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29240"
    },
    {
      "name": "CVE-2022-22807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22807"
    }
  ],
  "initial_release_date": "2022-02-09T00:00:00",
  "last_revision_date": "2022-02-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-123",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-02-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-039-01 du 08 f\u00e9vrier 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-039-04 du 08 f\u00e9vrier 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 09 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-039-05 du 08 f\u00e9vrier 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-039-03 du 08 f\u00e9vrier 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-03"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-039-06 du 08 f\u00e9vrier 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-06"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-039-02 du 08 f\u00e9vrier 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-02"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Modicon M262 Logic Controllers versions ant\u00e9rieures \u00e0 V5.1.6.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "MiCOM C264 versions ant\u00e9rieures \u00e0 B5.118, D1.92, D4.38, D5.25I et D6.18",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PowerLogic ION7400 versions ant\u00e9rieures \u00e0 3.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EPC2000 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EPack toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Easy Harmony GXU (gamme HMIGXU) Vijeo Designer Basic versions ant\u00e9rieures \u00e0 1.2.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "nanodac versions ant\u00e9rieures \u00e0 10.02",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Versadac toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMXNOR0200H RTU toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EPC3000 versions ant\u00e9rieures \u00e0 V5.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M241/M251 Logic Controllers versions ant\u00e9rieures \u00e0 V5.1.9.34",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SAGE RTU CPU C3414 version ant\u00e9rieures \u00e0 C3414-500-S02K5_P5 de SAGE RTU CPU3414",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "BMXNOE0100 (H) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "JACE-8000 versions ant\u00e9rieures \u00e0 Niagara 4.10u1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMENOC0321, BMENOC0301, BMENOC0311, BMENOS0300 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "6100A, 6180A, 6100XIO, 6180XIO, AeroDAQ toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Eurotherm E+PLC100 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCD6000 Industrial RTU versions ant\u00e9rieures \u00e0 SY-1101207, et N de SCD6000",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Pro-face SP-5B00, SP-5B10, SP-5B90, gamme ST6000 (mod\u00e8le GP-ProEX), gamme ET6000 versions ant\u00e9rieures \u00e0 V4.09.350",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Momentum MDI (171CBU*), MC80 (BMKC8*), HART (BMEAH*),V1.50 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "BMECRA31210, BMXCRA31200, BMXCRA31210, 140CRA31200, 140CRA31908 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMXNOE0100, BMXNOE0110, BMXNGD0100, BMXNOC0401 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Easergy MiCOM P40 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M258/LMC058 Logic Controllers versions ant\u00e9rieures \u00e0 5.0.4.18",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon Quantum CPU et Communication Modules toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Premium CPU et Communication Modules toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Easergy MiCOM P30 versions 660 \u00e0 674",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "PowerLogic ION9000 versions ant\u00e9rieures \u00e0 3.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Easergy C5x (C52/C53) versions ant\u00e9rieures \u00e0 1.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "gammes HMISTO et HMISTU/S5T toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PacDrive Eco/Pro/Pro2 Logic Controllers versions ant\u00e9rieures \u00e0 V1.66.5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Easergy P5 versions ant\u00e9rieures \u00e0 01.401.101",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "CPU Modicon M580 (BMEP* et BMEH*), BMXNOM0200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "BMXNOE0110 (H) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Gammes Pro-face GP4000, LT4000M et GP4000H toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "TCSEGPA23F14F, BMECXM0100 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "HMISCU Vijeo Designer versions V6.2SP11 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "PowerLogic PM8000 versions ant\u00e9rieures \u00e0 3.1.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "PacDrive M toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Easy Harmony ET6 (gamme HMIET) Vijeo Designer Basic versions ant\u00e9rieures \u00e0 1.2.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Momentum ENT (170ENT11*) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Gammes Pro-face GP4100, GP4000E et GP4000M toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMXNOM0200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IGSS Data Server versions ant\u00e9rieures \u00e0 15.0.0.22074",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "BMENOP0300, BMXNOR0200 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon LMC078 toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Harmony/ Magelis, gammes HMIGTU, HMIGTUX et HMIGK versions ant\u00e9rieures \u00e0 6.2 SP11 Multi HotFix 4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 versions ant\u00e9rieures \u00e0 3.50",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2021-22156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22156"
    },
    {
      "name": "CVE-2022-0222",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0222"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2022-24324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24324"
    }
  ],
  "initial_release_date": "2022-04-12T00:00:00",
  "last_revision_date": "2022-04-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-328",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-04-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-102-02 du 12 avril 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-102-02_Modicon_M340_Controller_and_Communication_Modules_Security_Notification.pdf\u0026p_Doc_Ref=SEVD-2022-102-02"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-102-01 du 12 avril 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification.pdf\u0026p_Doc_Ref=SEVD-2022-102-01"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 09 novembre 2021 mis \u00e0 jour le 12 avril 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification_V6.0.pdf\u0026p_Doc_Ref=SEVD-2021-313-05"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Schneider Electric C-Bus Network Automation Controller LSS5500SHAC versions ant\u00e9rieures \u00e0 1.11.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Clipsal C-Bus Network Automation Controller 5500SHAC versions ant\u00e9rieures \u00e0 1.11.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Conext ComBox toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SpaceLogic C-Bus Network Automation Controller 5500NAC2 versions ant\u00e9rieures \u00e0 1.11.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "CanBRASS versions ant\u00e9rieures \u00e0 7.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "StruxureWare Data Center Expert versions ant\u00e9rieures \u00e0 7.9.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Power Commission versions ant\u00e9rieures \u00e0 2.22",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Smart-UPS SMT SMC, SMX, SRC, XU, XP, SURTD, CHS2 et SRTL Series toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Cybersecurity Admin Expert (CAE) versions ant\u00e9rieures \u00e0 2.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "IGSS Data Server versions ant\u00e9rieures \u00e0 15.0.0.22170",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Geo SCADA Mobile versions ant\u00e9rieures au Build 202205171",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Smart-UPS SRT Series versions ant\u00e9rieures \u00e0 15.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Schneider Electric C-Bus Network Automation Controller LSS5500NAC versions ant\u00e9rieures \u00e0 1.11.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Power Build: Rapsody Software versions ant\u00e9rieures \u00e0 2.1.13",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EPC2000 versions ant\u00e9rieures \u00e0 4.03",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Versadac versions ant\u00e9rieures \u00e0 2.43",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Clipsal C-Bus Network Automation Controller 5500NAC versions ant\u00e9rieures \u00e0 1.11.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SCADAPack RemoteConnect pour x70 versions ant\u00e9rieures \u00e0 R2.7.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "SpaceLogic C-Bus Network Automation Controller 5500AC2 versions ant\u00e9rieures \u00e0 1.11.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Smart-UPS SCL Series versions ant\u00e9rieures \u00e0 15.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-32524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32524"
    },
    {
      "name": "CVE-2022-24322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24322"
    },
    {
      "name": "CVE-2022-22731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22731"
    },
    {
      "name": "CVE-2022-32514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32514"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2022-32517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32517"
    },
    {
      "name": "CVE-2022-32526",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32526"
    },
    {
      "name": "CVE-2022-32530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32530"
    },
    {
      "name": "CVE-2022-32748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32748"
    },
    {
      "name": "CVE-2022-22806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22806"
    },
    {
      "name": "CVE-2022-32529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32529"
    },
    {
      "name": "CVE-2022-32513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32513"
    },
    {
      "name": "CVE-2022-32747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32747"
    },
    {
      "name": "CVE-2022-32523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32523"
    },
    {
      "name": "CVE-2022-32528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32528"
    },
    {
      "name": "CVE-2022-32516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32516"
    },
    {
      "name": "CVE-2022-32522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32522"
    },
    {
      "name": "CVE-2022-32527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32527"
    },
    {
      "name": "CVE-2022-32515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32515"
    },
    {
      "name": "CVE-2021-22697",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22697"
    },
    {
      "name": "CVE-2022-0715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0715"
    },
    {
      "name": "CVE-2022-0223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0223"
    },
    {
      "name": "CVE-2022-32519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32519"
    },
    {
      "name": "CVE-2022-22805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22805"
    },
    {
      "name": "CVE-2022-24323",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24323"
    },
    {
      "name": "CVE-2022-32512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32512"
    },
    {
      "name": "CVE-2022-32518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32518"
    },
    {
      "name": "CVE-2022-22732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22732"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2022-32520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32520"
    },
    {
      "name": "CVE-2022-32525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32525"
    },
    {
      "name": "CVE-2021-22698",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22698"
    },
    {
      "name": "CVE-2022-32521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32521"
    }
  ],
  "initial_release_date": "2022-06-15T00:00:00",
  "last_revision_date": "2022-08-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-546",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-06-15T00:00:00.000000"
    },
    {
      "description": "Modification de la version des produits IGSS Data Server",
      "revision_date": "2022-06-23T00:00:00.000000"
    },
    {
      "description": "Mise \u00e0 jour du lien du bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-02 du 08 mars 2022.",
      "revision_date": "2022-08-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-02 du 08 mars 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-067-02_APC-Smart-UPS_Security_Notification_V6.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-07 du 14 juin 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-07_CanBRASS_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-06 du 14 juin 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-06_C-Bus_Home_Automation_Products_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-067-01 du 08 mars 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-067-01_EcoStruxure_Control_Expert_and_EcoStruxure_Process_Expert_Security_Notification_V2.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-02 du 14 juin 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-02_Geo_SCADA_Android_App_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-08 du 14 juin 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-012-02 du 12 janvier 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-012-02_EcoStruxure_Power_Build_Rapsody_Security_Notification_V2.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-04 du 14 juin 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-04_%20StruxureWare_Data_Center_Expert_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-01 du 14 juin 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-01_IGSS_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-05 du 14 juin 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 09 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification_V8.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-165-03 du 14 juin 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Eurotherm Data Reviewer3.0.2 software versions ant\u00e9rieures 4.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon Momentum MDI (171CBU*) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "EcoStruxure Control Expert versions ant\u00e9rieures \u00e0 15.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Process Expert versions ant\u00e9rieures \u00e0 2021",
      "product": {
        "name": "process",
        "vendor": {
          "name": "Symfony",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon M580 CPU (BMEP* et BMEH*) versions ant\u00e9rieures \u00e0 4.01",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Legacy Modicon Quantum toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "OPC UA Modicon Communication Module (BMENUA0100) versions ant\u00e9rieures \u00e0 2.01",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon MC80 (BMKC80) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 CPU (BMXP34*) versions ant\u00e9rieures 3.50",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-6846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6846"
    },
    {
      "name": "CVE-2022-34760",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34760"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2021-22791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22791"
    },
    {
      "name": "CVE-2022-34762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34762"
    },
    {
      "name": "CVE-2019-6841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6841"
    },
    {
      "name": "CVE-2021-45105",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-45105"
    },
    {
      "name": "CVE-2021-22779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22779"
    },
    {
      "name": "CVE-2021-22781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22781"
    },
    {
      "name": "CVE-2021-22780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22780"
    },
    {
      "name": "CVE-2021-4104",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-4104"
    },
    {
      "name": "CVE-2021-22790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22790"
    },
    {
      "name": "CVE-2022-37302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37302"
    },
    {
      "name": "CVE-2022-34761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34761"
    },
    {
      "name": "CVE-2022-34759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34759"
    },
    {
      "name": "CVE-2022-37301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37301"
    },
    {
      "name": "CVE-2018-7241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7241"
    },
    {
      "name": "CVE-2021-22786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22786"
    },
    {
      "name": "CVE-2018-7242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7242"
    },
    {
      "name": "CVE-2019-6844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6844"
    },
    {
      "name": "CVE-2019-6842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6842"
    },
    {
      "name": "CVE-2021-22782",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22782"
    },
    {
      "name": "CVE-2021-22778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22778"
    },
    {
      "name": "CVE-2022-34764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34764"
    },
    {
      "name": "CVE-2022-34763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34763"
    },
    {
      "name": "CVE-2021-45046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-45046"
    },
    {
      "name": "CVE-2022-37300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37300"
    },
    {
      "name": "CVE-2021-22789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22789"
    },
    {
      "name": "CVE-2019-6847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6847"
    },
    {
      "name": "CVE-2022-34765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34765"
    },
    {
      "name": "CVE-2021-44228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
    },
    {
      "name": "CVE-2021-22792",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22792"
    },
    {
      "name": "CVE-2019-6843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6843"
    },
    {
      "name": "CVE-2018-7240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7240"
    },
    {
      "name": "CVE-2011-4859",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4859"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2021-44832",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44832"
    },
    {
      "name": "CVE-2020-12525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-12525"
    }
  ],
  "initial_release_date": "2022-08-09T00:00:00",
  "last_revision_date": "2022-09-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-717",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-08-09T00:00:00.000000"
    },
    {
      "description": "Mise \u00e0 jour des liens",
      "revision_date": "2022-08-22T00:00:00.000000"
    },
    {
      "description": "Mise \u00e0 jour des liens des bulletins de s\u00e9curit\u00e9 Schneider SEVD-2022-221-01, SEVD-2022-221-02 et SEVD-2022-221-04 du 9 ao\u00fbt 2022.",
      "revision_date": "2022-09-08T00:00:00.000000"
    },
    {
      "description": "Ajout du libell\u00e9 [SCADA] dans le titre.",
      "revision_date": "2022-09-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SESB-2021-347-01 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2021-347-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SESB-2021-347-01_Apache_Log4j_Log4Shell_Vulnerabilities_Security_Notification_V14.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2019-281-02 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-281-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2019-281-02_Modicon_Controllers_Security_Notification_V3.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-01 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-01_EcoStruxure_Control_Expert_Modicon580_Security_Notification_V1.1.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-193-01 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules_Security_Notification_V3.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification_V10.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-03 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-03_EcoStruxure_Control_Expert_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-02 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-02_Modicon_Controllers_Security_Notification_V1.1.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2018-081-01 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2018-081-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2018-081-01_Embedded_FTP_Servers_for_Modicon_PAC_Controllers_Security_Notification_V3.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-222-04 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-222-04_Modicon_PAC_Controllers_PLC_Simulator_Control_Expert_Process_Expert_Security_Notification_V2.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-194-01 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-194-01_EcoStruxure_Control_Expert_Process_Expert_SCADAPack_RemoteConnect_Modicon_M580_M340_Security_Notifcation_V4.0.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-04 du 9 ao\u00fbt 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-04-Modicon_Controllers_Ethernet_Modules_Security_Notification_V1.1.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Modicon MC80 sans le correctif de s\u00e9curit\u00e9 BMKC8020301",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "CANopen X80 Communication Module (BMECXM0100) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon MC80 (BMKC80) versions ant\u00e9rieures \u00e0 1.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon MC80 Controller (BMKC8*) versions ant\u00e9rieures \u00e0 1.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 X80 Ethernet Communication Modules BMXNOE0110 (H) toutes versions",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 X80 Ethernet Communication Modules BMXNOE0100 (H) toutes versions",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure\u2122 Control Expert version 15.1 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Modicon RTU BMXNOR0200H versions ant\u00e9rieures \u00e0 1.7 IR24",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 X80 Ethernet Communication Module BMXNOR0200H RTU versions ant\u00e9rieures \u00e0 1.7 IR24",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 Ethernet TCP/IP Network Module BMXNOC0401 versions ant\u00e9rieures \u00e0 2.11",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Profibus Remote Master (TCSEGPA23F14F) toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Lexium ILE ILA ILS Communication Drive versions ant\u00e9rieures \u00e0 01.110",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 X80 Ethernet Communication module BMXNOC0401 versions ant\u00e9rieures \u00e0 version 2.11",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-7564",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7564"
    },
    {
      "name": "CVE-2020-7563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7563"
    },
    {
      "name": "CVE-2020-7535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7535"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2020-7549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7549"
    },
    {
      "name": "CVE-2021-31401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31401"
    },
    {
      "name": "CVE-2022-37301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37301"
    },
    {
      "name": "CVE-2018-7241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7241"
    },
    {
      "name": "CVE-2022-0222",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0222"
    },
    {
      "name": "CVE-2018-7242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7242"
    },
    {
      "name": "CVE-2021-31400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31400"
    },
    {
      "name": "CVE-2021-22788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22788"
    },
    {
      "name": "CVE-2020-35685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35685"
    },
    {
      "name": "CVE-2020-7562",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7562"
    },
    {
      "name": "CVE-2020-35683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35683"
    },
    {
      "name": "CVE-2020-35684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35684"
    },
    {
      "name": "CVE-2020-7536",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7536"
    },
    {
      "name": "CVE-2018-7857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7857"
    },
    {
      "name": "CVE-2019-6807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6807"
    },
    {
      "name": "CVE-2018-7240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-7240"
    },
    {
      "name": "CVE-2011-4859",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4859"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    },
    {
      "name": "CVE-2021-22787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22787"
    },
    {
      "name": "CVE-2021-22785",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22785"
    }
  ],
  "initial_release_date": "2022-09-13T00:00:00",
  "last_revision_date": "2022-09-13T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-313-05 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_Badalloc_Vulnerabilities_Security_Notification_V11.0.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-257-02 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-257-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-257-02_Web_Server_Modicon_M340_Quantum_and_Premium_and_Communication_Modules_V2.0.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2018-081-01 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2018-081-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2018-081-01_Embedded_FTP_Servers_for_Modicon_PAC_Controllers_Security_Notification_V4.0.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-343-06 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-343-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-343-06_Web_Server_Modicon_M340_Premium_Quantum_Communication_Modules_Security_Notification_V2.0.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-343-07 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-343-07\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-343-07_SNMP_Service_Modicon_M340_CPU_Security_Notification_V2.1.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2021-217-01 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-217-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-217-01_NicheStack_Security_Notification_V3.0.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2019-134-11 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-134-11\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2019-134-11_Modicon_Controllers_Security_Notification_V7.0.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-221-02 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-221-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-221-02_Modicon_Controllers_Security_Notification_V2.0.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SESB-2019-214-01 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2019-214-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SESB-2019-214-01_Wind_River_VxWorks_Security_Bulletin_V2.14.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-315-01 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-315-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-315-01_Modicon_Web_Server_Security_Notification_V3.0.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-343-05 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-343-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2020-343-05-Web_Server_Modicon_M340_Premium_Quantum_Communication_Modules_Security_Notification_V2.1.pdf"
    }
  ],
  "reference": "CERTFR-2022-AVI-815",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-09-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire, un d\u00e9ni de service et une atteinte \u00e0 la confidentialit\u00e9\ndes donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2022-256-01 du 13 septembre 2022",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-256-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-256-01-EcoStruxure_Machine_SCADA_ExpertPro-face_BLUE_Open_Studio_Security_Notification.pdf"
    }
  ]
}