Improper Condition Check in Modicon Products by Schneider Electric
CVE-2018-7794

7.5HIGH

Key Information:

Vendor
Schneider Electric
Status
Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see Security Notification For Specific Versions)
Vendor
CVE Published:
6 January 2020

Summary

A vulnerability in Schneider Electric’s Modicon PLCs, including models M580, M340, Quantum, and Premium, arises from improper checks for unusual conditions when reading data via Modbus TCP. An attacker could exploit this issue by sending invalid index requests, potentially leading to a Denial of Service, disrupting operations and compromising system availability.

Affected Version(s)

Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific ) Modicon M580

Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific ) Modicon M340

Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific ) Modicon Quantum

References

https://www.se.com/ww/en/download/document/SEVD-2019-344-01
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.