PT-2019-2273 · Schneider Electric · Modicon M340+3

Published 2019-05-14 · Updated 2022-02-03 · CVE-2018-7845

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Modicon M580 (affected versions not specified) Modicon M340 (affected versions not specified) Modicon Quantum (affected versions not specified) Modicon Premium (affected versions not specified)

Description A CWE-125: Out-of-bounds Read issue exists, which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus. The vulnerability is related to a buffer read out-of-bounds condition and can be exploited remotely, allowing an attacker to reveal protected information when reading certain memory blocks in the controller via the Modbus protocol.

Recommendations For Modicon M580, update to a version that fixes the out-of-bounds read issue. For Modicon M340, update to a version that fixes the out-of-bounds read issue. For Modicon Quantum, update to a version that fixes the out-of-bounds read issue. For Modicon Premium, update to a version that fixes the out-of-bounds read issue. As a temporary workaround, consider restricting access to the Modbus protocol to minimize the risk of exploitation.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2019-02044

CVE-2018-7845

Affected Products

Modicon M340

Modicon M580

Modicon Premium

Modicon Quantum

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0745 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7845 · Security Note
• https://bdu.fstec.ru/vul/2019-02044 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-134-11 · Vendor Advisory