PT-2019-2271 · Schneider Electric · Modicon Premium+3

Published 2019-05-14 · Updated 2022-02-03 · CVE-2018-7842

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Modicon M580 (affected versions not specified) Modicon M340 (affected versions not specified) Modicon Quantum (affected versions not specified) Modicon Premium (affected versions not specified)

Description A vulnerability exists that could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller. This issue is related to authentication bypass by spoofing, which may allow a remote attacker to exploit the vulnerability and gain elevated privileges.

Recommendations For Modicon M580, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon M340, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon Quantum, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon Premium, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2019-02042

CVE-2018-7842

Affected Products

Modicon M340

Modicon M580

Modicon Premium

Modicon Quantum

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0741 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7842 · Security Note
• https://bdu.fstec.ru/vul/2019-02042 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-134-11 · Vendor Advisory