PT-2019-11105 · Schneider Electric · Modicon Ethernet Module+1

Published 2019-07-15 · Updated 2022-04-19 · CVE-2018-7838

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Modicon M580 CPU - BMEP582040 versions prior to V2.90 Modicon Ethernet Module BMENOC0301 versions prior to V2.16

Description: A buffer error issue exists that could cause denial of service on the FTP service when it receives a FTP CWD command with a data length greater than 1020 bytes, requiring a power cycle to reactivate the FTP service.

Recommendations: For Modicon M580 CPU - BMEP582040 versions prior to V2.90, update to version V2.90 or later to resolve the issue. For Modicon Ethernet Module BMENOC0301 versions prior to V2.16, update to version V2.16 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-7838

Affected Products

Modicon Ethernet Module

Modicon M580 Cpu

References · 3

• https://osv.dev/vulnerability/CVE-2018-7838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7838 · Security Note
• https://schneider-electric.com/ww/en/download/document/SEVD-2019-190-03 · Vendor Advisory