PT-2019-3832 · Schneider Electric · Modicon Bmxcra+3

Published 2019-10-08 · Updated 2022-02-03 · CVE-2019-6844

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Modicon M580 (all firmware versions) Modicon M340 (all firmware versions) Modicon BMxCRA (all firmware versions) 140CRA (all firmware versions)

Description A vulnerability exists in the Modicon controllers due to the lack of integrity check of the firmware update. This could cause a Denial of Service attack on the PLC when upgrading the controller with a firmware package containing an invalid web server image using the FTP protocol. The issue is related to improper handling of exceptional conditions, which can be exploited by a remote attacker to load a firmware update with a damaged web server image, resulting in a service disruption.

Recommendations For Modicon M580, consider disabling the FTP protocol until a patch is available to prevent exploitation. For Modicon M340, restrict access to the firmware update feature to minimize the risk of exploitation. For Modicon BMxCRA and 140CRA, avoid using the firmware package containing an invalid web server image until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-248

CWE-755

Related Identifiers

BDU:2019-04191

CVE-2019-6844

Affected Products

140Cra

Modicon Bmxcra

Modicon M340

Modicon M580

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-6844 · Security Note
• https://bdu.fstec.ru/vul/2019-04191 · Security Note
• https://se.com/ww/en/download/document/SEVD-2019-281-02 · Vendor Advisory
• https://schneider-electric.com/en/download/document/SEVD-2019-281-02 · Note
• https://t.me/cvenotify/13437 · Telegram Post