PT-2019-3833 · Schneider Electric · Modicon Bmxcra+3
Publicado
2019-10-08
·
Atualizado
2022-02-03
·
CVE-2019-6847
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Modicon M580 (all firmware versions)
Modicon M340 (all firmware versions)
Modicon BMxCRA (all firmware versions)
140CRA (all firmware versions)
Description
A vulnerability exists in the Modicon controllers' firmware, related to the improper handling of exceptional conditions. This issue is associated with the lack of version checking for firmware updates. When upgrading the firmware using the FTP protocol with a version incompatible with the application in the controller, it could cause a Denial of Service attack on the FTP service. The vulnerability can be exploited remotely, allowing an attacker to upload an incompatible firmware version, resulting in a denial of service.
Recommendations
For Modicon M580, consider disabling the FTP service until a compatible firmware version is available.
For Modicon M340, restrict access to the FTP protocol to minimize the risk of exploitation.
For Modicon BMxCRA and 140CRA, avoid using the FTP protocol for firmware updates until a patch is available.
As a temporary workaround, consider implementing additional security measures to restrict remote access to the controllers.
Correção
Improper Handling of Exceptional Conditions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
140Cra
Modicon Bmxcra
Modicon M340
Modicon M580