High severity · published Dec 17, 2018
CVE-2018-7833
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an…
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can send a specially crafted XML data via a POST request to cause the web server to become unavailable
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Modicom Bmxnor0200h Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicom M340 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MP
Modicom Premium Firmware · Schneider-electric
All versions, or not specified · source: NVD
MQ
Modicom Quantum Firmware · Schneider-electric
All versions, or not specified · source: NVD
Affected product
MB
Modicom Bmxnor0200h Firmware
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7833
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7833
Vendor Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/
More from Modicom Bmxnor0200h Firmware
9.8
CVE-2018-7811
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated…
9.8
CVE-2018-7809
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated…
8.8
CVE-2018-7831
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and…
7.5
CVE-2018-7812
An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends…
7.5
CVE-2018-7830
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs…