Schneider Electric is aware of multiple vulnerabilities in its Triconex™ Tricon™ Main Processor (MP), Tricon Communication Module (TCM), and Unified Communication Module (UCM) products.
The affected products (listed below) are main processor modules and communication modules intended for use with Tricon and Tricon CX systems.
Failure to apply the remediations provided in this document may risk a denial of service attack, which could result in a module reset.

The following modules when installed in Tricon or Tricon CX version 11.3.x – 11.7.x systems are affected:
? Tricon Main Processor Models 3009 and 3009X
? Tricon Communication Module (TCM) Models 4351B, 4352B, and 4355X
? Unified Communication Module (UCM) Model 4610X

CVE ID: CVE-2021-22742
CVSS v3.1 Base Score 3.9 | Low | CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Model 3009/3009XMP that could cause a module reset when the TCM receives malformed TriStation packets while the write-protect keyswitch is in the PROGRAM position.
CVE ID: CVE-2021-22743
CVSS v3.1 Base Score 3.9 | Low | CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Models 4351B/4352B/4355X TCM and Model 4610X UCM that could cause a module reset when the TCM receives malformed TriStation packets while the write-protect keyswitch is in the PROGRAM position.