PT-2019-2334 · Schneider Electric · Modicon M580+3

Jared Rittle · Published 2019-05-14 · Updated 2022-02-03 · CVE-2019-6807

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Modicon M580 (affected versions not specified) Modicon M340 (affected versions not specified) Modicon Quantum (affected versions not specified) Modicon Premium (affected versions not specified)

Description A vulnerability exists that could cause a denial of service when writing sensitive application variables to the controller over Modbus. This issue is related to an uncaught exception and can be exploited by a remote attacker to disrupt service.

Recommendations For Modicon M580, update or apply a fix to resolve the uncaught exception issue. For Modicon M340, update or apply a fix to resolve the uncaught exception issue. For Modicon Quantum, update or apply a fix to resolve the uncaught exception issue. For Modicon Premium, update or apply a fix to resolve the uncaught exception issue. As a temporary workaround, consider restricting access to the Modbus protocol to minimize the risk of exploitation.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-248

Related Identifiers

BDU:2019-02109

CVE-2019-6807

Affected Products

Modicon M340

Modicon M580

Modicon Premium

Modicon Quantum

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0770 · Exploit
• https://bdu.fstec.ru/vul/2019-02109 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-134-11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6807 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6807 · Vendor Advisory