PT-2019-3831 · Schneider Electric · Modicon Bmxcra+3

Published 2019-10-08 · Updated 2022-02-03 · CVE-2019-6843

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Modicon M580 versions prior to V3.10 Modicon M340 (all firmware versions) Modicon BMxCRA and 140CRA modules (all firmware versions)

Description A vulnerability exists in the Modicon controllers due to the lack of integrity check of the firmware update. This could allow a remote attacker to upload a firmware update with an empty image using the FTP protocol, causing a Denial of Service attack on the PLC. The issue is related to improper handling of exceptional conditions.

Recommendations For Modicon M580 versions prior to V3.10, update the firmware to version V3.10 or later. For Modicon M340, restrict access to the FTP protocol until a fix is available. For Modicon BMxCRA and 140CRA modules, avoid using the FTP protocol for firmware updates until a patch is released. As a temporary workaround, consider disabling the FTP protocol for firmware updates on all affected devices until a fix is available.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-248

CWE-755

Related Identifiers

BDU:2019-04190

CVE-2019-6843

Affected Products

Modicon 140Cra

Modicon Bmxcra

Modicon M340

Modicon M580

References · 5

• https://bdu.fstec.ru/vul/2019-04190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-6843 · Security Note
• https://se.com/ww/en/download/document/SEVD-2019-281-02 · Vendor Advisory
• https://schneider-electric.com/en/download/document/SEVD-2019-281-02 · Note
• https://t.me/cvenotify/13431 · Telegram Post