PT-2018-1977 · Schneider Electric · Bmxnor0200+3

Publicado 2018-11-05 · Atualizado 2018-12-28 · CVE-2018-7804

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (affected versions not specified)

Description The issue is related to insufficient input validation in the microprogram software of Modicon controllers. This can allow an attacker to redirect a user to a malicious site by exploiting the vulnerability. Specifically, a user clicking on a specially crafted link can be redirected to a URL of the attacker's choosing.

Recommendations For Modicon M340, Premium, Quantum PLCs and BMXNOR0200, consider restricting access to the embedded web server until a fix is available. As a temporary workaround, avoid clicking on links from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

BDU:2018-01587

CVE-2018-7804

Produtos afetados

Bmxnor0200

Modicon M340

Premium

Quantum

Referências · 3

• https://bdu.fstec.ru/vul/2018-01587 · Nota de Segurança
• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7804 · Nota de Segurança