PT-2019-2274 · Schneider Electric · Modicon M340+3

Published 2019-05-14 · Updated 2022-02-03 · CVE-2018-7846

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Modicon M580 versions (affected versions not specified) Modicon M340 versions (affected versions not specified) Modicon Quantum versions (affected versions not specified) Modicon Premium versions (affected versions not specified)

Description The issue is related to a trust boundary violation when connecting to the controller, which could allow an attacker to gain unauthorized access by conducting a brute force attack on the Modbus protocol.

Recommendations For Modicon M580, update to a version that addresses the trust boundary violation issue. For Modicon M340, update to a version that addresses the trust boundary violation issue. For Modicon Quantum, update to a version that addresses the trust boundary violation issue. For Modicon Premium, update to a version that addresses the trust boundary violation issue. As a temporary workaround, consider restricting access to the Modbus protocol to minimize the risk of exploitation.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-501

Related Identifiers

BDU:2019-02045

CVE-2018-7846

Affected Products

Modicon M340

Modicon M580

Modicon Premium

Modicon Quantum

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0735 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7846 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-134-11 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02045 · Security Note