Medium severity · published May 22, 2019
CVE-2018-7850
A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which…
5.3
CVSS
1.5%
EPSS
No
On KEV
Description
A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Modicon M340 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M580 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MP
Modicon Premium Firmware · Schneider-electric
All versions, or not specified · source: NVD
MQ
Modicon Quantum Firmware · Schneider-electric
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7850
Vendor Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0743
More from Modicon M340 Firmware
9.8
CVE-2020-7475
A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert…
9.8
CVE-2019-6808
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code…
9.8
CVE-2018-7847
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service…
9.8
CVE-2018-7846
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium…
9.8
CVE-2018-7842
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an…