High severity · published Jul 15, 2019
CVE-2018-7838
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which…
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Bmeh582040 Firmware · Schneider-electric
before 2.90 · source: NVD
BF
Bmeh586040 Firmware · Schneider-electric
before 2.90 · source: NVD
BF
Bmenoc0301 Firmware · Schneider-electric
before 2.16 · source: NVD
MM
Modicon M580 Bmep581020 Firmware · Schneider-electric
before 2.90 · source: NVD
MM
Modicon M580 Bmep582020 Firmware · Schneider-electric
before 2.90 · source: NVD
MM
Modicon M580 Bmep582040 Firmware · Schneider-electric
before 2.90 · source: NVD
MM
Modicon M580 Bmep582040s Firmware · Schneider-electric
before 2.90 · source: NVD
MM
Modicon M580 Bmep583020 Firmware · Schneider-electric
before 2.90 · source: NVD
MM
Modicon M580 Bmep583040 Firmware · Schneider-electric
before 2.90 · source: NVD
MM
Modicon M580 Bmep584020 Firmware · Schneider-electric
before 2.90 · source: NVD
MM
Modicon M580 Bmep584040 Firmware · Schneider-electric
before 2.90 · source: NVD
MM
Modicon M580 Bmep585040 Firmware · Schneider-electric
before 2.90 · source: NVD
