PT-2018-2171 · Schneider Electric · Bmxnor0200+3

Publicado 2018-11-23 · Atualizado 2018-12-28 · CVE-2018-7830

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (affected versions not specified)

Description The issue is related to improper neutralization of CRLF sequences in HTTP headers, also known as 'HTTP Response Splitting'. This can lead to a denial of service, which can last for approximately 1 minute, by sending a specially crafted HTTP request. The vulnerability can be exploited to cause a device outage.

Recommendations For Modicon M340, Premium, Quantum PLCs and BMXNOR0200, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-113

Identificadores relacionados

BDU:2019-00124

CVE-2018-7830

Produtos afetados

Bmxnor0200

Modicon M340

Premium

Quantum

Referências · 4

• 🔥 https://tenable.com/security/research/tra-2018-38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7830 · Nota de Segurança
• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00124 · Nota de Segurança