PT-2013-1301 · Schneider Electric · M340+4

Published 2013-04-04 · Updated 2013-04-04 · CVE-2013-0664

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric Quantum versions 140NOE77111 and 140NWM10000 M340 BMXNOE0110x Premium TSXETY5103

Description The issue allows remote authenticated users to execute arbitrary code by sending Modbus messages embedded in SOAP HTTP POST requests. This is due to insufficient input validation in the FactoryCast service component of the Schneider Electric Modicon M340 programmable logic controller's software.

Recommendations For Schneider Electric Quantum versions 140NOE77111 and 140NWM10000, consider disabling the FactoryCast service until a patch is available. For M340 BMXNOE0110x, restrict access to the SOAP HTTP POST requests to minimize the risk of exploitation. For Premium TSXETY5103, avoid using the FactoryCast service until the issue is resolved. As a temporary workaround, consider restricting the use of the Modbus messages in the SOAP requests until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-11597

CVE-2013-0664

Affected Products

Factorycast

M340

Modicon M340

Premium

Schneider Electric Quantum

References · 7

• http://schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11597 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-0664 · Security Note
• http://schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper · Vendor Advisory
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0664; · Note
• http://osvdb.org/show/osvdb/89330 · Note
• http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf · Note