IM
IronMonkey Threat Research

CVE-2018-7240 HIGH

Published: 2018-04-18 | Last Modified: 2026-06-17 | Status: Modified

Description

A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution. An FTP command used to upgrade the firmware of the module can be misused to cause a denial of service, or in extreme cases, to load a malicious firmware.

Additional Descriptions (1)

Existe una vulnerabilidad en Modicon Quantum, de Schneider Electric, en todas las versiones de los módulos de comunicación que podría permitir la ejecución de código arbitrario. Un comando FTP usado para actualizar el firmware del módulo puede emplearse erróneamente para provocar una denegación de servicio (DoS) o, en casos extremos, cargar un firmware malicioso.

CVSS Metrics

Base Score: 6.5 (MEDIUM)

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationSINGLE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Primary
en CWE-787

Affected Products

Vendor Product Version Update Type
schneider-electric 140cpu65150_firmware - <built-in method update of dict object at 0x7e60eb2ae140> Operating System
schneider-electric 140cpu31110_firmware - <built-in method update of dict object at 0x7e60bae0c980> Operating System
schneider-electric 140cpu43412u_firmware - <built-in method update of dict object at 0x7e60eb2ad940> Operating System
schneider-electric 140cpu65160_firmware - <built-in method update of dict object at 0x7e60e885a940> Operating System
schneider-electric 140cpu65260_firmware - <built-in method update of dict object at 0x7e60eb2aed80> Operating System
schneider-electric 140cpu65860_firmware - <built-in method update of dict object at 0x7e60eb2ac080> Operating System
schneider-electric 140cpu65160s_firmware - <built-in method update of dict object at 0x7e60bae0fc80> Operating System
schneider-electric 140cpu65150c_firmware - <built-in method update of dict object at 0x7e60bae0ca00> Operating System
schneider-electric 140cpu31110c_firmware - <built-in method update of dict object at 0x7e60e885bd00> Operating System
schneider-electric 140cpu43412uc_firmware - <built-in method update of dict object at 0x7e60eb2acf80> Operating System
schneider-electric 140cpu65160c_firmware - <built-in method update of dict object at 0x7e60e8816b00> Operating System
schneider-electric 140cpu65160c_firmware - <built-in method update of dict object at 0x7e60bae0fac0> Operating System
schneider-electric 140cpu65260c_firmware - <built-in method update of dict object at 0x7e60bae0e700> Operating System
schneider-electric 140cpu65860c_firmware - <built-in method update of dict object at 0x7e60bae0d900> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65150_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65150:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu31110_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu31110:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu43412u_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu43412u:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65160_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65160:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65260_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65260:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65860_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65860:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65160s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65160s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65150c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65150c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu31110c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu31110c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu43412uc_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu43412uc:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65160c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65160c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65160c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65160c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65260c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65260c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:140cpu65860c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:140cpu65860c:-:*:*:*:*:*:*:*

References

Notification
Message here