PT-2019-3832 · Schneider Electric · Modicon Bmxcra+3
Publicado
2019-10-08
·
Atualizado
2022-02-03
·
CVE-2019-6844
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Modicon M580 (all firmware versions)
Modicon M340 (all firmware versions)
Modicon BMxCRA (all firmware versions)
140CRA (all firmware versions)
Description
A vulnerability exists in the Modicon controllers due to the lack of integrity check of the firmware update. This could cause a Denial of Service attack on the PLC when upgrading the controller with a firmware package containing an invalid web server image using the FTP protocol. The issue is related to improper handling of exceptional conditions, which can be exploited by a remote attacker to load a firmware update with a damaged web server image, resulting in a service disruption.
Recommendations
For Modicon M580, consider disabling the FTP protocol until a patch is available to prevent exploitation.
For Modicon M340, restrict access to the firmware update feature to minimize the risk of exploitation.
For Modicon BMxCRA and 140CRA, avoid using the firmware package containing an invalid web server image until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Handling of Exceptional Conditions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
140Cra
Modicon Bmxcra
Modicon M340
Modicon M580