PT-2019-2281 · Schneider Electric · Modicon M580+3
Published
2019-05-14
·
Updated
2022-02-03
·
CVE-2018-7855
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Modicon M580 versions prior to a fixed version
Modicon M340 versions prior to a fixed version
Modicon Quantum versions prior to a fixed version
Modicon Premium versions prior to a fixed version
Description
The issue is related to an uncaught exception in the programmable logic controller's software, which can be exploited by sending invalid breakpoint parameters to the controller using the Modbus protocol. This could cause a Denial of Service. The estimated number of potentially affected devices is not specified.
Recommendations
For Modicon M580 versions prior to the fixed version, update to the latest version to resolve the issue.
For Modicon M340 versions prior to the fixed version, update to the latest version to resolve the issue.
For Modicon Quantum versions prior to the fixed version, update to the latest version to resolve the issue.
For Modicon Premium versions prior to the fixed version, update to the latest version to resolve the issue.
As a temporary workaround, consider restricting access to the Modbus protocol to minimize the risk of exploitation.
Exploit
Fix
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Modicon M340
Modicon M580
Modicon Premium
Modicon Quantum