CVE-2019-6819 HIGH

Published: 2019-05-22 | Last Modified: 2026-06-17 | Status: Modified

Description

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.

Additional Descriptions (1)

Una CWE-754: Existe una vulnerabilidad de Comprobación Inapropiada para condiciones inusuales o excepcionales, que podría generar una posible Denegación de Servicio cuando se envían tramas Modbus específicas hacia el controlador en los productos: Modicon M340 - versiones de firmware anteriores a la V3.01, Modicon M580 - versiones de firmware anteriores a V2.80, y todas las versiones de firmware de Modicon Quantum y Modicon Premium.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-754
[email protected]	Primary	en CWE-754

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_m340_firmware	*	<built-in method update of dict object at 0x7e610746a700>	Operating System
schneider-electric	modicon_m580_firmware	*	<built-in method update of dict object at 0x7e60bbd63e40>	Operating System
schneider-electric	modicon_quantum_firmware	*	<built-in method update of dict object at 0x7e60baa0b440>	Operating System
schneider-electric	modicon_premium_firmware	*	<built-in method update of dict object at 0x7e60e88755c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000h:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102cl:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302cl:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:bmeh582040:-:::::::*`
No	`cpe:2.3:h:schneider-electric:bmeh582040c:-:::::::*`
No	`cpe:2.3:h:schneider-electric:bmeh584040:-:::::::*`
No	`cpe:2.3:h:schneider-electric:bmeh584040c:-:::::::*`
No	`cpe:2.3:h:schneider-electric:bmeh586040:-:::::::*`
No	`cpe:2.3:h:schneider-electric:bmeh586040c:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:::::::*`
No	`cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_premium_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_premium:-:::::::*`

References

http://www.securityfocus.com/bid/109004
Source: [email protected]

Broken Link
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/
Source: [email protected]

Vendor Advisory
http://www.securityfocus.com/bid/109004
Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory