High severity · published May 22, 2019
CVE-2018-7843
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when…
7.5
CVSS
3.2%
EPSS
No
On KEV
Description
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Modicon M340 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M580 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MP
Modicon Premium Firmware · Schneider-electric
All versions, or not specified · source: NVD
MQ
Modicon Quantum Firmware · Schneider-electric
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7843
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7843
Vendor Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0738
More from Modicon M340 Firmware
9.8
CVE-2020-7475
A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert…
9.8
CVE-2019-6808
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code…
9.8
CVE-2018-7847
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service…
9.8
CVE-2018-7846
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium…
9.8
CVE-2018-7842
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an…