PT-2018-2174 · Schneider Electric · Bmxnor0200+3

Published 2018-12-07 · Updated 2018-12-28 · CVE-2018-7833

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs versions (affected versions not specified) BMXNOR0200 versions (affected versions not specified)

Description The issue is related to insufficient checking of unusual or exceptional conditions in the programmable logic controllers' software. It can be exploited by sending specially crafted XML data using a POST request, which may cause the web server to become unavailable.

Recommendations For Modicon M340, Premium, Quantum PLCs, restrict access to the web server to minimize the risk of exploitation. For BMXNOR0200, avoid using the vulnerable web server functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2019-00127

CVE-2018-7833

Affected Products

Bmxnor0200

Modicon M340

Premium

Quantum Plcs

References · 3

• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00127 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-7833 · Security Note