PT-2019-2281 · Schneider Electric · Modicon M580+3
Publicado
2019-05-14
·
Atualizado
2022-02-03
·
CVE-2018-7855
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Modicon M580 versions prior to a fixed version
Modicon M340 versions prior to a fixed version
Modicon Quantum versions prior to a fixed version
Modicon Premium versions prior to a fixed version
Description
The issue is related to an uncaught exception in the programmable logic controller's software, which can be exploited by sending invalid breakpoint parameters to the controller using the Modbus protocol. This could cause a Denial of Service. The estimated number of potentially affected devices is not specified.
Recommendations
For Modicon M580 versions prior to the fixed version, update to the latest version to resolve the issue.
For Modicon M340 versions prior to the fixed version, update to the latest version to resolve the issue.
For Modicon Quantum versions prior to the fixed version, update to the latest version to resolve the issue.
For Modicon Premium versions prior to the fixed version, update to the latest version to resolve the issue.
As a temporary workaround, consider restricting access to the Modbus protocol to minimize the risk of exploitation.
Exploit
Correção
Improper Check for Exceptional Conditions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Modicon M340
Modicon M580
Modicon Premium
Modicon Quantum