PT-2019-2272 · Schneider Electric · Modicon M340+3

Published 2019-05-14 · Updated 2022-02-03 · CVE-2018-7843

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Modicon M580 (affected versions not specified) Modicon M340 (affected versions not specified) Modicon Quantum (affected versions not specified) Modicon Premium (affected versions not specified)

Description A vulnerability exists in the Modicon programmable logic controller software related to errors in handling exceptional situations. This issue could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service.

Recommendations For Modicon M580, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon M340, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon Quantum, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon Premium, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-248

Related Identifiers

BDU:2019-02043

CVE-2018-7843

Affected Products

Modicon M340

Modicon M580

Modicon Premium

Modicon Quantum

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0738 · Exploit
• https://schneider-electric.com/en/download/document/SEVD-2019-134-11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7843 · Security Note
• https://bdu.fstec.ru/vul/2019-02043 · Security Note