PT-2019-11106 · Schneider Electric · Modicon M580+3

Published 2019-05-22 · Updated 2026-05-29 · CVE-2018-7852

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Modicon M580 (affected versions not specified) Modicon M340 (affected versions not specified) Modicon Quantum (affected versions not specified) Modicon Premium (affected versions not specified)

Description: A denial of service issue exists due to an uncaught exception when an invalid private command parameter is sent to the controller over Modbus.

Recommendations: For Modicon M580, restrict access to the Modbus interface to minimize the risk of exploitation. For Modicon M340, avoid using invalid private command parameters in the Modbus protocol until the issue is resolved. For Modicon Quantum, consider implementing input validation for private command parameters to prevent denial of service. For Modicon Premium, restrict access to the Modbus interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-248

CWE-755

Related Identifiers

CVE-2018-7852

Affected Products

Modicon M340

Modicon M580

Modicon Premium

Modicon Quantum

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0763 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7852 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-134-11 · Vendor Advisory
• https://t.me/cveNotify/165212 · Telegram Post