PT-2019-3829 · Schneider Electric · Modicon Bmxcra+3
Publicado
2019-10-08
·
Atualizado
2022-02-03
·
CVE-2019-6841
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Modicon M580 versions prior to V3.10
Modicon M340 (all firmware versions)
Modicon BMxCRA and 140CRA modules (all firmware versions)
Description
A vulnerability exists in the Modicon controllers related to the improper handling of exceptional conditions, which could cause a Denial of Service attack on the PLC when upgrading the firmware with no firmware image inside the package using the FTP protocol. The issue is associated with the lack of integrity check of the firmware update. This could allow a remote attacker to load a firmware update without a firmware image via the FTP protocol and cause a denial of service.
Recommendations
For Modicon M580 versions prior to V3.10, update the firmware to version V3.10 or later.
For Modicon M340, restrict access to the FTP protocol until a fix is available.
For Modicon BMxCRA and 140CRA modules, avoid using the FTP protocol for firmware updates until a fix is available.
As a temporary workaround, consider disabling the FTP protocol for firmware updates on all affected devices until a patch is available.
Correção
Improper Handling of Exceptional Conditions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Modicon 140Cra
Modicon Bmxcra
Modicon M340
Modicon M580