PT-2018-2174 · Schneider Electric · Bmxnor0200+3

Publicado 2018-12-07 · Atualizado 2018-12-28 · CVE-2018-7833

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs versions (affected versions not specified) BMXNOR0200 versions (affected versions not specified)

Description The issue is related to insufficient checking of unusual or exceptional conditions in the programmable logic controllers' software. It can be exploited by sending specially crafted XML data using a POST request, which may cause the web server to become unavailable.

Recommendations For Modicon M340, Premium, Quantum PLCs, restrict access to the web server to minimize the risk of exploitation. For BMXNOR0200, avoid using the vulnerable web server functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

Identificadores relacionados

BDU:2019-00127

CVE-2018-7833

Produtos afetados

Bmxnor0200

Modicon M340

Premium

Quantum Plcs

Referências · 3

• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00127 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-7833 · Nota de Segurança