CVE-2018-7833 HIGH

Published: 2018-12-17 | Last Modified: 2026-06-17 | Status: Modified

Description

An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can send a specially crafted XML data via a POST request to cause the web server to become unavailable

Additional Descriptions (1)

Existe una vulnerabilidad de comprobación incorrecta de condiciones inusuales o excepcionales en los servidores web embebidos en todos los Modicon M340, Premium, Quantum PLCs y BMXNOR0200, donde un usuario no autenticado puede enviar datos XML especialmente manipulados mediante una petición POST para provocar que el servidor web deje de estar disponible.

CVSS Metrics

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-754

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicom_m340_firmware	*	<built-in method update of dict object at 0x7e60e8877400>	Operating System
schneider-electric	modicom_premium_firmware	*	<built-in method update of dict object at 0x7e60eb25e400>	Operating System
schneider-electric	modicom_quantum_firmware	*	<built-in method update of dict object at 0x7e60eb25fe80>	Operating System
schneider-electric	modicom_bmxnor0200h_firmware	*	<built-in method update of dict object at 0x7e6112cb56c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicom_m340_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicom_m340:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicom_premium_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicom_premium::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicom_quantum_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicom_quantum::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicom_bmxnor0200h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicom_bmxnor0200h:-:::::::*`

References

https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/
Source: [email protected]

Vendor Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory