PT-2019-2279 · Schneider Electric · Modicon M580+3

Published 2019-05-14 · Updated 2022-02-03 · CVE-2018-7853

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Modicon M580 (affected versions not specified) Modicon M340 (affected versions not specified) Modicon Quantum (affected versions not specified) Modicon Premium (affected versions not specified)

Description The issue is related to an uncaught exception in the programmable logic controller's software, which can be exploited by a remote attacker to cause a denial of service. This can happen when the controller reads invalid physical memory blocks using the Modbus protocol.

Recommendations For Modicon M580, update to a version that includes a fix for the uncaught exception issue. For Modicon M340, update to a version that includes a fix for the uncaught exception issue. For Modicon Quantum, update to a version that includes a fix for the uncaught exception issue. For Modicon Premium, update to a version that includes a fix for the uncaught exception issue. As a temporary workaround, consider restricting access to the Modbus protocol to minimize the risk of exploitation.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-248

Related Identifiers

BDU:2019-02050

CVE-2018-7853

Affected Products

Modicon M340

Modicon M580

Modicon Premium

Modicon Quantum

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0764 · Exploit
• https://bdu.fstec.ru/vul/2019-02050 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7853 · Vendor Advisory
• https://schneider-electric.com/en/download/document/SEVD-2019-134-11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7853 · Security Note
• https://t.me/cvenotify/26214 · Telegram Post