PT-2019-2276 · Schneider Electric · Modicon M580+3

Published 2019-05-14 · Updated 2022-02-03 · CVE-2018-7848

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Modicon M580 (affected versions not specified) Modicon M340 (affected versions not specified) Modicon Quantum (affected versions not specified) Modicon Premium (affected versions not specified)

Description A vulnerability exists that could cause the disclosure of SNMP information when reading files from the controller over Modbus. This issue may allow a remote attacker to disclose information.

Recommendations For Modicon M580, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon M340, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon Quantum, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Modicon Premium, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-02047

CVE-2018-7848

Affected Products

Modicon M340

Modicon M580

Modicon Premium

Modicon Quantum

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0740 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7848 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-134-11 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7848 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02047 · Security Note