// Description
# Schneider Electric Security Notification
8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0 Page 1 of 9
# Modicon Controllers
8 October 2019 (13 August 2024)
## Overview
Schneider Electric is aware of multiple vulnerabilities in the Modicon Controller products. August 2024 Update: Remediation for the Modicon M580 CPU Safety is available for download (page 4).
## Affected Products & Remediations
## Vulnerability Details
CVE ID: CVE-2019-6841
CVSS v3.0 Base Score 4.9 | (Medium) | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a Denial of Service of the controller when upgrading the firmware with no firmware image inside the package using FTP protocol .
CVE ID: CVE-2019-6842
CVSS v3.0 Base Score 4.9 | (Medium) | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause aDenial of Service of the controller when upgrading the firmware with a missing web server image inside the package using FTP protocol .
Affected Products and Versions CVE-
> 2019-6841 2019-6842 2019-6843 2019-6844 2019-6846 2019-6847
Modicon M580 (part numbers BMEP* & BMEH*, excluding M580 CPU Safety), Versions prior to SV4.10 x x x x x xModicon M580 CPU Safety (part numbers BMEP58*S & BMEH58*S), Versions prior to SV4.21 x x x x x xModicon M340, Versions prior to SV3.50 x x x x x xModicon BMxCRA and 140CRA modules, all versions x x x x x xSchneider Electric Security Notification
8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0 Page 2 of 9
CVE ID: CVE-2019-6843
CVSS v3.0 Base Score 4.9 | (Medium) | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a Denial of Service of the controller when upgrading the controller with an empty firmware package using FTP protocol .
CVE ID: CVE-2019-6844