PT-2018-2171 · Schneider Electric · Bmxnor0200+3

Published 2018-11-23 · Updated 2018-12-28 · CVE-2018-7830

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (affected versions not specified)

Description The issue is related to improper neutralization of CRLF sequences in HTTP headers, also known as 'HTTP Response Splitting'. This can lead to a denial of service, which can last for approximately 1 minute, by sending a specially crafted HTTP request. The vulnerability can be exploited to cause a device outage.

Recommendations For Modicon M340, Premium, Quantum PLCs and BMXNOR0200, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-113

Related Identifiers

BDU:2019-00124

CVE-2018-7830

Affected Products

Bmxnor0200

Modicon M340

Premium

Quantum

References · 4

• 🔥 https://tenable.com/security/research/tra-2018-38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7830 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00124 · Security Note