CVE-2019-6848 HIGH

Published: 2019-10-29 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BMENOC0321) (see notification for version info), which could cause a Denial of Service attack on the PLC when sending specific data on the REST API of the controller/communication module.

Additional Descriptions (1)

Existe una vulnerabilidad CWE-755: Manejo inadecuado de condiciones excepcionales en la CPU Modicon M580 (BMEx58*) y en el módulo de comunicación Modicon M580 (BMENOC0311, BMENOC0321) (consulte la notificación para obtener información sobre la versión), que podría provocar un ataque de denegación de servicio en el PLC al enviar datos específicos en la API REST del controlador/módulo de comunicación

CVSS Metrics

Base Score: 8.6 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	CHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 4.0

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-755
[email protected]	Primary	en CWE-755

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_m580_firmware	-	<built-in method update of dict object at 0x7e60eb226c80>	Operating System
schneider-electric	modicon_bmenoc_0311_firmware	-	<built-in method update of dict object at 0x7e60a88af180>	Operating System
schneider-electric	modicon_bmenoc_0321_firmware	-	<built-in method update of dict object at 0x7e60eb225580>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_bmenoc_0311_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_bmenoc_0311:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_bmenoc_0321_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_bmenoc_0321:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2019-281-04/
Source: [email protected]
https://www.se.com/ww/en/download/document/SEVD-2019-281-04/
Source: af854a3a-2127-422b-91ae-364da2661108