CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum.
Una CWE-330: Una vulnerabilidad de Uso Insuficientes de valores aleatorios, podría generar el secuestro de la conexión TCP cuando se utiliza el protocolo de comunicación Ethernet en Modicon M580 versiones de firmware anteriores a V2.30, y todas las versiones de firmware de Modicon M340, Modicon Premium, Modicon Quantum.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | LOW |
| Availability Impact | NONE |
AV:N/AC:L/Au:N/C:P/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-330
|
| [email protected] | Primary |
en
CWE-330
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | modicon_m580_firmware | * | <built-in method update of dict object at 0x7e60bac6d700> | Operating System |
| schneider-electric | modicon_m340_firmware | * | <built-in method update of dict object at 0x7e60bac6f780> | Operating System |
| schneider-electric | modicon_quantum_firmware | * | <built-in method update of dict object at 0x7e60bac6d500> | Operating System |
| schneider-electric | modicon_premium_firmware | * | <built-in method update of dict object at 0x7e60bac6f9c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicon_m580:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicon_quantum_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicon_quantum:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:modicon_premium_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:modicon_premium:-:*:*:*:*:*:*:* |