PT-2019-2277 · Schneider Electric · Modicon M340+3
Publicado
2019-05-14
·
Atualizado
2022-02-03
·
CVE-2018-7849
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Modicon M580 versions (affected versions not specified)
Modicon M340 versions (affected versions not specified)
Modicon Quantum versions (affected versions not specified)
Modicon Premium versions (affected versions not specified)
Description
The issue is related to an uncaught exception in the programmable logic controller's software, which can be exploited by a remote attacker to cause a denial of service. This occurs when the controller improperly checks the integrity of files sent over the Modbus protocol, specifically when the files have incorrect checksums.
Recommendations
For Modicon M580, update the software to a version that properly handles exceptions and checks data integrity.
For Modicon M340, implement a workaround to correctly validate the integrity of files sent over Modbus.
For Modicon Quantum, restrict access to the Modbus protocol until a patch is available that fixes the improper data integrity check.
For Modicon Premium, consider disabling the Modbus protocol temporarily until a software update is released that addresses the uncaught exception vulnerability.
Exploit
Correção
Improper Handling of Exceptional Conditions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Modicon M340
Modicon M580
Modicon Premium
Modicon Quantum