CVE-2019-6843 MEDIUM

Published: 2019-10-29 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the controller with an empty firmware package using FTP protocol.

Additional Descriptions (1)

Existe una vulnerabilidad CWE-755: Manejo inadecuado de condiciones excepcionales en Modicon M580 con firmware (versión anterior a V3.10), Modicon M340 (todas las versiones de firmware) y módulos Modicon BMxCRA y 140CRA (todas las versiones de firmware), que podría causar un ataque de denegación de servicio en el PLC al actualizar el controlador con un paquete de firmware vacío utilizando el protocolo FTP

CVSS Metrics

Base Score: 4.9 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	HIGH
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.2

Impact Score: 3.6

Base Score: 4.0 (MEDIUM)

AV:N/AC:L/Au:S/C:N/I:N/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	SINGLE
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-755
[email protected]	Primary	en CWE-755

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_m580_firmware	*	<built-in method update of dict object at 0x7e60baa0a040>	Operating System
schneider-electric	modicon_m340_firmware	*	<built-in method update of dict object at 0x7e6110c9ae00>	Operating System
schneider-electric	modicon_bmxcra_firmware	*	<built-in method update of dict object at 0x7e610746b540>	Operating System
schneider-electric	modicon_140cra_firmware	*	<built-in method update of dict object at 0x7e60e8874f00>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_bmxcra_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_bmxcra:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_140cra_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_140cra:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2019-281-02/
Source: [email protected]

Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2019-281-02/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory