PT-2018-18260 · Schneider Electric · Micom Px4X+2

Publicado 2018-04-18 · Atualizado 2018-05-29 · CVE-2018-7758

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:A/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board Schneider Electric's MiCOM P540D Range with Legacy Ethernet Board Schneider Electric's MiCOM Px4x Rejuvenated

Description: A denial of service issue exists due to TCP/IP open requests on port 20000 (DNP3oE) when an older TCI/IP session is still open with an identical IP address and port number, potentially causing loss of network communication.

Recommendations: For Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board, consider restricting access to port 20000 to minimize the risk of exploitation. For Schneider Electric's MiCOM P540D Range with Legacy Ethernet Board, avoid using identical IP address and port number for new TCP/IP sessions if an older session is still open. For Schneider Electric's MiCOM Px4x Rejuvenated, restrict network communication on port 20000 until a fix is available.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2018-7758

Produtos afetados

Micom P540D Range

Micom Px4X

Micom Px4X Rejuvenated

Referências · 4

• https://schneider-electric.com/en/download/document/SEVD-2018-074-04 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7758 · Nota de Segurança
• https://schneider-electric.com/en/download/document/SEVD-2018-074-03 · Aviso do Fabricante
• https://schneider-electric.com/en/download/document/SEVD-2018-074-02 · Aviso do Fabricante