PT-2012-1182 · Schneider Electric · Schneider Electric Modicon Quantum Plc+1

Published 2012-01-27 · Updated 2020-07-23 · CVE-2012-0929

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon Quantum PLC (affected versions not specified) Schneider Electric Modicon M340 (affected versions not specified)

Description The issue is caused by multiple buffer overflows in the PLC's software, allowing remote attackers to cause a denial of service. This can be achieved by sending malformed requests to the FTP server or HTTP server. The exploitation of this issue may allow an attacker to cause a denial of service using specially crafted FTP or HTTP requests.

Recommendations For Schneider Electric Modicon Quantum PLC, consider restricting access to the FTP and HTTP servers until a fix is available. For Schneider Electric Modicon M340, as a temporary workaround, consider disabling the FTP and HTTP servers to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-11598

CVE-2012-0929

Affected Products

Schneider Electric Modicon M340

Schneider Electric Modicon Quantum Plc

References · 10

• https://bdu.fstec.ru/vul/2015-11598 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-0929 · Security Note
• http://secunia.com/advisories/47723 · Note
• http://osvdb.org/show/osvdb/78498 · Note
• https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-12-020-03 · Note
• http://us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf · Note
• http://securityfocus.com/bid/51605 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72588 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72589 · Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0929; · Note