PT-2018-1977 · Schneider Electric · Bmxnor0200+3

Published 2018-11-05 · Updated 2018-12-28 · CVE-2018-7804

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (affected versions not specified)

Description The issue is related to insufficient input validation in the microprogram software of Modicon controllers. This can allow an attacker to redirect a user to a malicious site by exploiting the vulnerability. Specifically, a user clicking on a specially crafted link can be redirected to a URL of the attacker's choosing.

Recommendations For Modicon M340, Premium, Quantum PLCs and BMXNOR0200, consider restricting access to the embedded web server until a fix is available. As a temporary workaround, avoid clicking on links from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2018-01587

CVE-2018-7804

Affected Products

Bmxnor0200

Modicon M340

Premium

Quantum

References · 3

• https://bdu.fstec.ru/vul/2018-01587 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7804 · Security Note