Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-6819 (GCVE-0-2019-6819)
Vulnerability from cvelistv5 – Published: 2019-05-22 19:45 – Updated: 2024-08-04 20:31
VLAI?
EPSS
Summary
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.
Severity ?
No CVSS data available.
CWE
- CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium |
Affected:
Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:31:04.277Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/"
},
{
"name": "109004",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/109004"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-03T13:06:07",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/"
},
{
"name": "109004",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/109004"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"ID": "CVE-2019-6819",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium",
"version": {
"version_data": [
{
"version_value": "Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-754: Improper Check for Unusual or Exceptional Conditions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/",
"refsource": "MISC",
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/"
},
{
"name": "109004",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/109004"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2019-6819",
"datePublished": "2019-05-22T19:45:08",
"dateReserved": "2019-01-25T00:00:00",
"dateUpdated": "2024-08-04T20:31:04.277Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.01\", \"matchCriteriaId\": \"606AFE88-8C9A-4D18-9209-1193B628669F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"178D2338-E48E-493C-992F-337AACE794DE\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000h:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"69222495-4F18-434E-B86C-F63C5A2C1242\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D150239-27E2-4CBE-A931-5107C15E362F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"98212CF5-BCF4-4A55-B62A-484569687B4E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102cl:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D30336F0-EDCF-486C-B52E-D0C53BCDFC65\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"99F2F851-C18F-4CB8-B47C-516F2AC7955D\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56BAED8B-EEFA-45D7-A5A3-9B62067CE24C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"354968F7-C41B-4C21-8E47-81DC07DF0EA5\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302cl:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32091F91-9397-4506-8801-C68B9E8B60F0\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"075A16D1-F4DF-4DCB-8DF9-152E282CE01F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.80\", \"matchCriteriaId\": \"6FDEB227-D50B-402C-9C11-E29F52BC10BB\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:bmeh582040:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4E6E5E62-BBA8-4370-A232-8E1196757C3E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:bmeh582040c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C393EAE-D2A1-42BC-8CE8-2DCAC96EB769\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:bmeh584040:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2A8BF9D-AFD1-4F19-A0DB-5EB6F343D890\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:bmeh584040c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"63D48211-A734-4F98-A4D5-569268335757\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:bmeh586040:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"38D22DD5-677B-42E8-AE1F-11601D4BF110\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:bmeh586040c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"79907FE7-B4B0-4732-9287-B7ED13115F6C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2317F260-7AA2-4178-B468-03DF36223E26\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3D7DDC42-37A1-43B0-AD46-2E0D098564BA\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"765E4FEE-255E-4C47-824A-5661B84B490B\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B1FEA377-3C45-4F88-B233-088A24BD0771\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EBCCDD6D-35CE-4680-8B0C-86584B1D8958\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"68FD5968-C522-4231-A98C-93D3101B6148\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C02B27F6-B8CF-4D3B-9DA6-054F540EA6B6\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BBC38FF1-693E-4899-883C-1B7B80A52F2C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"002E7F33-6729-4C35-9DDA-7D8383BD5668\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"47DFEBAC-2F1D-4870-8425-2199BF80B425\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC4A1DF2-FF4C-4DBE-BF74-6A4A09E3DECE\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6222C1F8-BE52-4666-B7F5-2E8BBC214F70\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5376D9F4-8AFB-4909-A11B-33C54C4220DB\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CADB178B-FEFD-48A9-B155-0E8F6D490229\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6B3C1879-269B-47EB-891B-EF2E90C911D7\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5771A1A5-3DAF-4869-A24F-F9B0A38B5DA5\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:schneider-electric:modicon_quantum_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"745CC7A7-70FB-4551-8EBF-600B7A6236D7\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_quantum:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A9B7CEF7-B9BA-4923-808F-DA2931569EBB\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:schneider-electric:modicon_premium_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"619CFD8D-9652-4AAB-AFC4-796B3F10F61F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:modicon_premium:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F00936E2-E6EF-4ABF-8666-7D83BE424F42\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.\"}, {\"lang\": \"es\", \"value\": \"Una CWE-754: Existe una vulnerabilidad de Comprobaci\\u00f3n Inapropiada para condiciones inusuales o excepcionales, que podr\\u00eda generar una posible Denegaci\\u00f3n de Servicio cuando se env\\u00edan tramas Modbus espec\\u00edficas hacia el controlador en los productos: Modicon M340 - versiones de firmware anteriores a la V3.01, Modicon M580 - versiones de firmware anteriores a V2.80, y todas las versiones de firmware de Modicon Quantum y Modicon Premium.\"}]",
"id": "CVE-2019-6819",
"lastModified": "2024-11-21T04:47:12.980",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2019-05-22T20:29:02.090",
"references": "[{\"url\": \"http://www.securityfocus.com/bid/109004\", \"source\": \"cybersecurity@se.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/\", \"source\": \"cybersecurity@se.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/109004\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"cybersecurity@se.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-754\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-754\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2019-6819\",\"sourceIdentifier\":\"cybersecurity@se.com\",\"published\":\"2019-05-22T20:29:02.090\",\"lastModified\":\"2024-11-21T04:47:12.980\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.\"},{\"lang\":\"es\",\"value\":\"Una CWE-754: Existe una vulnerabilidad de Comprobaci\u00f3n Inapropiada para condiciones inusuales o excepcionales, que podr\u00eda generar una posible Denegaci\u00f3n de Servicio cuando se env\u00edan tramas Modbus espec\u00edficas hacia el controlador en los productos: Modicon M340 - versiones de firmware anteriores a la V3.01, Modicon M580 - versiones de firmware anteriores a V2.80, y todas las versiones de firmware de Modicon Quantum y Modicon Premium.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cybersecurity@se.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-754\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-754\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.01\",\"matchCriteriaId\":\"606AFE88-8C9A-4D18-9209-1193B628669F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"178D2338-E48E-493C-992F-337AACE794DE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000h:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69222495-4F18-434E-B86C-F63C5A2C1242\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D150239-27E2-4CBE-A931-5107C15E362F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98212CF5-BCF4-4A55-B62A-484569687B4E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102cl:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D30336F0-EDCF-486C-B52E-D0C53BCDFC65\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"99F2F851-C18F-4CB8-B47C-516F2AC7955D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56BAED8B-EEFA-45D7-A5A3-9B62067CE24C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"354968F7-C41B-4C21-8E47-81DC07DF0EA5\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302cl:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32091F91-9397-4506-8801-C68B9E8B60F0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"075A16D1-F4DF-4DCB-8DF9-152E282CE01F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.80\",\"matchCriteriaId\":\"6FDEB227-D50B-402C-9C11-E29F52BC10BB\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:bmeh582040:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E6E5E62-BBA8-4370-A232-8E1196757C3E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:bmeh582040c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C393EAE-D2A1-42BC-8CE8-2DCAC96EB769\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:bmeh584040:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2A8BF9D-AFD1-4F19-A0DB-5EB6F343D890\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:bmeh584040c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63D48211-A734-4F98-A4D5-569268335757\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:bmeh586040:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38D22DD5-677B-42E8-AE1F-11601D4BF110\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:bmeh586040c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79907FE7-B4B0-4732-9287-B7ED13115F6C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2317F260-7AA2-4178-B468-03DF36223E26\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D7DDC42-37A1-43B0-AD46-2E0D098564BA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"765E4FEE-255E-4C47-824A-5661B84B490B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1FEA377-3C45-4F88-B233-088A24BD0771\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EBCCDD6D-35CE-4680-8B0C-86584B1D8958\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68FD5968-C522-4231-A98C-93D3101B6148\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C02B27F6-B8CF-4D3B-9DA6-054F540EA6B6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBC38FF1-693E-4899-883C-1B7B80A52F2C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"002E7F33-6729-4C35-9DDA-7D8383BD5668\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47DFEBAC-2F1D-4870-8425-2199BF80B425\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC4A1DF2-FF4C-4DBE-BF74-6A4A09E3DECE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6222C1F8-BE52-4666-B7F5-2E8BBC214F70\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5376D9F4-8AFB-4909-A11B-33C54C4220DB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CADB178B-FEFD-48A9-B155-0E8F6D490229\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B3C1879-269B-47EB-891B-EF2E90C911D7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5771A1A5-3DAF-4869-A24F-F9B0A38B5DA5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:schneider-electric:modicon_quantum_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"745CC7A7-70FB-4551-8EBF-600B7A6236D7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_quantum:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9B7CEF7-B9BA-4923-808F-DA2931569EBB\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:schneider-electric:modicon_premium_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"619CFD8D-9652-4AAB-AFC4-796B3F10F61F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:modicon_premium:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F00936E2-E6EF-4ABF-8666-7D83BE424F42\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/109004\",\"source\":\"cybersecurity@se.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/\",\"source\":\"cybersecurity@se.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/109004\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
VAR-201905-0035
Vulnerability from variot - Updated: 2024-04-18 13:26A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium. plural Modicon The product contains an exceptional condition check vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. The Modicon M340 is a complex device and small and medium-sized project programmable controller (PLC). Modicon Premium is a complex control programmable controller (PLC). Modicon Quantum is a process control programmable controller (PLC). The Modicon M580 is a programmable automation controller (PAC). Modicon M580/M340/Premium/Quantum has an abnormality check for anomalies. An attacker could exploit the vulnerability by sending a specific Modbus frame to cause a denial of service. Schneider Electric Modicon Controllers are prone to a denial-of-service vulnerability. Schneider Electric Modicon M580, etc. are all products of French Schneider Electric (Schneider Electric). This vulnerability stems from improper design or implementation problems in the code development process of network systems or products
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201905-0035",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "modicon m340",
"scope": "lt",
"trust": 1.8,
"vendor": "schneider electric",
"version": "3.01"
},
{
"model": "modicon m580",
"scope": "lt",
"trust": 1.8,
"vendor": "schneider electric",
"version": "2.80"
},
{
"model": "modicon quantum",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "*"
},
{
"model": "modicon premium",
"scope": "eq",
"trust": 1.0,
"vendor": "schneider electric",
"version": "*"
},
{
"model": "modicon premium plc",
"scope": null,
"trust": 0.8,
"vendor": "schneider electric",
"version": null
},
{
"model": "modicon quantum plc",
"scope": null,
"trust": 0.8,
"vendor": "schneider electric",
"version": null
},
{
"model": "electric modicon m340",
"scope": "lt",
"trust": 0.6,
"vendor": "schneider",
"version": "v3.01"
},
{
"model": "electric modicon quantum",
"scope": null,
"trust": 0.6,
"vendor": "schneider",
"version": null
},
{
"model": "electric modicon premium",
"scope": null,
"trust": 0.6,
"vendor": "schneider",
"version": null
},
{
"model": "electric modicon m580",
"scope": "lt",
"trust": 0.6,
"vendor": "schneider",
"version": "v2.80"
},
{
"model": "modicon quantum",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "0"
},
{
"model": "modicon premium",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "0"
},
{
"model": "modicon m580",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "2.30"
},
{
"model": "modicon m580",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "2.20"
},
{
"model": "modicon m340",
"scope": "eq",
"trust": 0.3,
"vendor": "schneider electric",
"version": "2.9"
},
{
"model": "modicon m580",
"scope": "ne",
"trust": 0.3,
"vendor": "schneider electric",
"version": "2.80"
},
{
"model": "modicon m340",
"scope": "ne",
"trust": 0.3,
"vendor": "schneider electric",
"version": "3.01"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "modicon m340",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "modicon m580",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "modicon quantum",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "modicon premium",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"db": "BID",
"id": "109004"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.01",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000h:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102cl:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302cl:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.80",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:bmeh582040:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:bmeh582040c:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:bmeh584040:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:bmeh584040c:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:bmeh586040:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:bmeh586040c:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:modicon_quantum_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_quantum:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:schneider-electric:modicon_premium_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:schneider-electric:modicon_premium:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zhang Xiaoming, Sun Zhonghao and Luo bing of CNCERT/CC., Zhang Jiawei",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201905-931"
}
],
"trust": 0.6
},
"cve": "CVE-2019-6819",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-6819",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-15937",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "87dc0327-d573-496f-a02c-d0b520f33b35",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-158254",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-6819",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-6819",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2019-15937",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201905-931",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-158254",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"db": "VULHUB",
"id": "VHN-158254"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-931"
},
{
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium. plural Modicon The product contains an exceptional condition check vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. The Modicon M340 is a complex device and small and medium-sized project programmable controller (PLC). Modicon Premium is a complex control programmable controller (PLC). Modicon Quantum is a process control programmable controller (PLC). The Modicon M580 is a programmable automation controller (PAC). Modicon M580/M340/Premium/Quantum has an abnormality check for anomalies. An attacker could exploit the vulnerability by sending a specific Modbus frame to cause a denial of service. Schneider Electric Modicon Controllers are prone to a denial-of-service vulnerability. Schneider Electric Modicon M580, etc. are all products of French Schneider Electric (Schneider Electric). This vulnerability stems from improper design or implementation problems in the code development process of network systems or products",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-6819"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"db": "BID",
"id": "109004"
},
{
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"db": "VULHUB",
"id": "VHN-158254"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-6819",
"trust": 3.6
},
{
"db": "BID",
"id": "109004",
"trust": 2.0
},
{
"db": "SCHNEIDER",
"id": "SEVD-2019-134-05",
"trust": 1.7
},
{
"db": "ICS CERT",
"id": "ICSA-19-183-01",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-201905-931",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2019-15937",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2019.2424",
"trust": 0.6
},
{
"db": "IVD",
"id": "87DC0327-D573-496F-A02C-D0B520F33B35",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-158254",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"db": "VULHUB",
"id": "VHN-158254"
},
{
"db": "BID",
"id": "109004"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-931"
},
{
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"id": "VAR-201905-0035",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"db": "VULHUB",
"id": "VHN-158254"
}
],
"trust": 1.8935065
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"db": "CNVD",
"id": "CNVD-2019-15937"
}
]
},
"last_update_date": "2024-04-18T13:26:48.716000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SEVD-2019-134-05",
"trust": 0.8,
"url": "https://www.schneider-electric.com/en/download/document/sevd-2019-134-05/"
},
{
"title": "Modicon M580/M340/Premium/Quantum exception check for patches for improper vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/162447"
},
{
"title": "Multiple Schneider Electric Product code issue vulnerability fixes",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=92897"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-931"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-754",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-158254"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/109004"
},
{
"trust": 1.7,
"url": "https://www.schneider-electric.com/en/download/document/sevd-2019-134-05/"
},
{
"trust": 1.7,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-183-01"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-6819"
},
{
"trust": 0.9,
"url": "http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6819"
},
{
"trust": 0.6,
"url": "https://web.nvd.nist.gov//vuln/detail/cve-2019-6819"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.2424/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"db": "VULHUB",
"id": "VHN-158254"
},
{
"db": "BID",
"id": "109004"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-931"
},
{
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"db": "VULHUB",
"id": "VHN-158254"
},
{
"db": "BID",
"id": "109004"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-931"
},
{
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-30T00:00:00",
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"date": "2019-05-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"date": "2019-05-22T00:00:00",
"db": "VULHUB",
"id": "VHN-158254"
},
{
"date": "2019-07-02T00:00:00",
"db": "BID",
"id": "109004"
},
{
"date": "2019-06-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"date": "2019-05-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-931"
},
{
"date": "2019-05-22T20:29:02.090000",
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-15937"
},
{
"date": "2019-07-03T00:00:00",
"db": "VULHUB",
"id": "VHN-158254"
},
{
"date": "2019-07-02T00:00:00",
"db": "BID",
"id": "109004"
},
{
"date": "2019-07-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-004815"
},
{
"date": "2019-07-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-931"
},
{
"date": "2024-04-10T12:28:45.957000",
"db": "NVD",
"id": "CVE-2019-6819"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201905-931"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Modicon Vulnerability related to exceptional condition checking in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-004815"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Code problem",
"sources": [
{
"db": "IVD",
"id": "87dc0327-d573-496f-a02c-d0b520f33b35"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-931"
}
],
"trust": 0.8
}
}
CERTFR-2019-AVI-312
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | SCADAPack 300 E et 500 E series RTU (312E, 313E, 314E, 330E, 333E, 337E, 350E, 530E, 535E) | ||
| Schneider Electric | N/A | SCADAPack 57x RTU (570, 575) | ||
| Schneider Electric | N/A | SCADAPack 300 series RTU (314, 330, 334, 350) | ||
| Schneider Electric | Modicon M340 | Modicon M340 versions antérieures à V2.70 | ||
| Schneider Electric | N/A | Modicon M580 versions antérieures à V2.90 | ||
| Schneider Electric | N/A | Modicon Quantum versions antérieures à V3.12 | ||
| Schneider Electric | N/A | Interactive Graphical SCADA System (IGSS) versions antérieures à 13.0.0.19140 | ||
| Schneider Electric | N/A | Modicon M580 versions antérieures à V2.01 | ||
| Schneider Electric | N/A | Modicon Ethernet Module BMENOC0301 versions antérieures à V2.16 | ||
| Schneider Electric | Modicon M340 | Modicon M340 versions antérieures à V3.01 | ||
| Schneider Electric | N/A | Interactive Graphical SCADA System (IGSS) versions 14.x antérieures à 14.0.0.19120 | ||
| Schneider Electric | N/A | Modicon M221 | ||
| Schneider Electric | N/A | Zelio Soft 2 versions antérieures à v5.3 | ||
| Schneider Electric | N/A | Modicon Premium versions antérieures à V3.10 | ||
| Schneider Electric | N/A | SCADAPack 32 RTU | ||
| Schneider Electric | N/A | Control Expert versions antérieures à V14.0 sans le dernier correctif de sécurité | ||
| Schneider Electric | N/A | Modicon Momentum M1E 171CBU98090Modicon Momentum M1E 171CBU98091 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SCADAPack 300 E et 500 E series RTU (312E, 313E, 314E, 330E, 333E, 337E, 350E, 530E, 535E)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack 57x RTU (570, 575)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack 300 series RTU (314, 330, 334, 350)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 versions ant\u00e9rieures \u00e0 V2.70",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 versions ant\u00e9rieures \u00e0 V2.90",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Quantum versions ant\u00e9rieures \u00e0 V3.12",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Interactive Graphical SCADA System (IGSS) versions ant\u00e9rieures \u00e0 13.0.0.19140",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 versions ant\u00e9rieures \u00e0 V2.01",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Ethernet Module BMENOC0301 versions ant\u00e9rieures \u00e0 V2.16",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 versions ant\u00e9rieures \u00e0 V3.01",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Interactive Graphical SCADA System (IGSS) versions 14.x ant\u00e9rieures \u00e0 14.0.0.19120",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M221",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Zelio Soft 2 versions ant\u00e9rieures \u00e0 v5.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Premium versions ant\u00e9rieures \u00e0 V3.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack 32 RTU",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Control Expert versions ant\u00e9rieures \u00e0 V14.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Momentum M1E 171CBU98090Modicon Momentum M1E 171CBU98091",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-6028",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6028"
},
{
"name": "CVE-2018-7846",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7846"
},
{
"name": "CVE-2019-6822",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6822"
},
{
"name": "CVE-2018-7842",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7842"
},
{
"name": "CVE-2018-7849",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7849"
},
{
"name": "CVE-2018-7838",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7838"
},
{
"name": "CVE-2019-6827",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6827"
},
{
"name": "CVE-2018-7854",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7854"
},
{
"name": "CVE-2018-7844",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7844"
},
{
"name": "CVE-2018-7847",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7847"
},
{
"name": "CVE-2019-6808",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6808"
},
{
"name": "CVE-2018-7850",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7850"
},
{
"name": "CVE-2018-7856",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7856"
},
{
"name": "CVE-2018-7845",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7845"
},
{
"name": "CVE-2018-7857",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7857"
},
{
"name": "CVE-2019-6807",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6807"
},
{
"name": "CVE-2019-6819",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6819"
},
{
"name": "CVE-2019-6806",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6806"
},
{
"name": "CVE-2018-7853",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7853"
},
{
"name": "CVE-2018-7843",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7843"
},
{
"name": "CVE-2018-7848",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7848"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-312",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-07-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-05 du 02 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-05-Modicon+Controllers-V1.1.pdf\u0026p_Doc_Ref=SEVD-2019-134-05"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-01 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-01-Zelio-Soft-2.pdf\u0026p_Doc_Ref=SEVD-2019-190-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2017-065-01 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2017-065-01-Modicon-SCADAPack-V2.0.pdf\u0026p_Doc_Ref=SEVD-2017-065-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-11 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-11-Modicon-Controllers-V1.1.pdf\u0026p_Doc_Ref=SEVD-2019-134-11"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-02 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-02-IGSS.pdf\u0026p_Doc_Ref=SEVD-2019-190-02"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-03 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-03-Modicon-M580-Controller.pdf\u0026p_Doc_Ref=SEVD-2019-190-03"
}
]
}
CERTFR-2019-AVI-232
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Modicon LMC058 | ||
| Schneider Electric | Modicon M340 | Modicon M340 firmware | ||
| Schneider Electric | N/A | Modicon LMC078 | ||
| Schneider Electric | N/A | Schneider Electric Floating License Manager versions antérieures à V2.3.1.0 | ||
| Schneider Electric | N/A | Modicon Premium | ||
| Schneider Electric | N/A | Modicon M241 | ||
| Schneider Electric | N/A | PacDrive Pro2 | ||
| Schneider Electric | N/A | Modicon M100 | ||
| Schneider Electric | N/A | 140CRA312xxx | ||
| Schneider Electric | N/A | BMxCRA312xx versions antérieures à V2.40 | ||
| Schneider Electric | N/A | Modicon M251 | ||
| Schneider Electric | N/A | ATV IMC drive controller | ||
| Schneider Electric | N/A | Modicon M580 firmware versions antérieures à V2.80 | ||
| Schneider Electric | N/A | Modicon M221 | ||
| Schneider Electric | N/A | Modicon M258 | ||
| Schneider Electric | N/A | TSXETG100 | ||
| Schneider Electric | N/A | NET55XX Encoder firmware versions antérieures à 2.1.9.7 | ||
| Schneider Electric | N/A | PacDrive Pro | ||
| Schneider Electric | N/A | BMX-NOR-0200H firmware versions antérieures à V1.7 IR 19 | ||
| Schneider Electric | N/A | Modicon M200 | ||
| Schneider Electric | N/A | Modicon Quantum | ||
| Schneider Electric | N/A | PacDrive Eco |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modicon LMC058",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 firmware",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon LMC078",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Floating License Manager versions ant\u00e9rieures \u00e0 V2.3.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Premium",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M241",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive Pro2",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M100",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "140CRA312xxx",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMxCRA312xx versions ant\u00e9rieures \u00e0 V2.40",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M251",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "ATV IMC drive controller",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 firmware versions ant\u00e9rieures \u00e0 V2.80",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M221",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M258",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "TSXETG100",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "NET55XX Encoder firmware versions ant\u00e9rieures \u00e0 2.1.9.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive Pro",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMX-NOR-0200H firmware versions ant\u00e9rieures \u00e0 V1.7 IR 19",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M200",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Quantum",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive Eco",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-6814",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6814"
},
{
"name": "CVE-2019-6812",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6812"
},
{
"name": "CVE-2018-20031",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20031"
},
{
"name": "CVE-2018-20032",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20032"
},
{
"name": "CVE-2018-20034",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20034"
},
{
"name": "CVE-2018-20033",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20033"
},
{
"name": "CVE-2019-6815",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6815"
},
{
"name": "CVE-2019-6816",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6816"
},
{
"name": "CVE-2018-7788",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7788"
},
{
"name": "CVE-2018-7851",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7851"
},
{
"name": "CVE-2018-7834",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7834"
},
{
"name": "CVE-2019-6819",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6819"
},
{
"name": "CVE-2019-6821",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6821"
},
{
"name": "CVE-2019-6820",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6820"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-232",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-05-17T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une\nex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de service \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-06 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-06+-+Modicon+RTU+Module.pdf\u0026p_Doc_Ref=SEVD-2019-134-06"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-10 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-10+-+Modicon+Controller.pdf\u0026p_Doc_Ref=SEVD-2019-134-10"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-05 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-05+-+Modicon+Controller.pdf\u0026p_Doc_Ref=SEVD-2019-134-05"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-09 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-09+-+Modicon+Quantum.pdf\u0026p_Doc_Ref=SEVD-2019-134-09"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-01 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-01+-+Pelco+Endura+NET55XX+Encoder.pdf\u0026p_Doc_Ref=SEVD-2019-134-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-04 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-04+-Schneider+Electric+Floating+License+Manager.pdf\u0026p_Doc_Ref=SEVD-2019-134-04"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-08 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-08+-+Modicon+Quantum.pdf\u0026p_Doc_Ref=SEVD-2019-134-08"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-03 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-03+-+Modicon+Controller.pdf\u0026p_Doc_Ref=SEVD-2019-134-03"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-02 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-02+-+Modicon+and+PacDrive+controllers.pdf\u0026p_Doc_Ref=SEVD-2019-134-02"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-07 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-07+-+ConneXium+Gateway.pdf\u0026p_Doc_Ref=SEVD-2019-134-07"
}
]
}
CERTFR-2019-AVI-232
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | Modicon LMC058 | ||
| Schneider Electric | Modicon M340 | Modicon M340 firmware | ||
| Schneider Electric | N/A | Modicon LMC078 | ||
| Schneider Electric | N/A | Schneider Electric Floating License Manager versions antérieures à V2.3.1.0 | ||
| Schneider Electric | N/A | Modicon Premium | ||
| Schneider Electric | N/A | Modicon M241 | ||
| Schneider Electric | N/A | PacDrive Pro2 | ||
| Schneider Electric | N/A | Modicon M100 | ||
| Schneider Electric | N/A | 140CRA312xxx | ||
| Schneider Electric | N/A | BMxCRA312xx versions antérieures à V2.40 | ||
| Schneider Electric | N/A | Modicon M251 | ||
| Schneider Electric | N/A | ATV IMC drive controller | ||
| Schneider Electric | N/A | Modicon M580 firmware versions antérieures à V2.80 | ||
| Schneider Electric | N/A | Modicon M221 | ||
| Schneider Electric | N/A | Modicon M258 | ||
| Schneider Electric | N/A | TSXETG100 | ||
| Schneider Electric | N/A | NET55XX Encoder firmware versions antérieures à 2.1.9.7 | ||
| Schneider Electric | N/A | PacDrive Pro | ||
| Schneider Electric | N/A | BMX-NOR-0200H firmware versions antérieures à V1.7 IR 19 | ||
| Schneider Electric | N/A | Modicon M200 | ||
| Schneider Electric | N/A | Modicon Quantum | ||
| Schneider Electric | N/A | PacDrive Eco |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Modicon LMC058",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 firmware",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon LMC078",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Schneider Electric Floating License Manager versions ant\u00e9rieures \u00e0 V2.3.1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Premium",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M241",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive Pro2",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M100",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "140CRA312xxx",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMxCRA312xx versions ant\u00e9rieures \u00e0 V2.40",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M251",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "ATV IMC drive controller",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 firmware versions ant\u00e9rieures \u00e0 V2.80",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M221",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M258",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "TSXETG100",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "NET55XX Encoder firmware versions ant\u00e9rieures \u00e0 2.1.9.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive Pro",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "BMX-NOR-0200H firmware versions ant\u00e9rieures \u00e0 V1.7 IR 19",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M200",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Quantum",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PacDrive Eco",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-6814",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6814"
},
{
"name": "CVE-2019-6812",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6812"
},
{
"name": "CVE-2018-20031",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20031"
},
{
"name": "CVE-2018-20032",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20032"
},
{
"name": "CVE-2018-20034",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20034"
},
{
"name": "CVE-2018-20033",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20033"
},
{
"name": "CVE-2019-6815",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6815"
},
{
"name": "CVE-2019-6816",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6816"
},
{
"name": "CVE-2018-7788",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7788"
},
{
"name": "CVE-2018-7851",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7851"
},
{
"name": "CVE-2018-7834",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7834"
},
{
"name": "CVE-2019-6819",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6819"
},
{
"name": "CVE-2019-6821",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6821"
},
{
"name": "CVE-2019-6820",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6820"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-232",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-05-17T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une\nex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de service \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-06 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-06+-+Modicon+RTU+Module.pdf\u0026p_Doc_Ref=SEVD-2019-134-06"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-10 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-10+-+Modicon+Controller.pdf\u0026p_Doc_Ref=SEVD-2019-134-10"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-05 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-05+-+Modicon+Controller.pdf\u0026p_Doc_Ref=SEVD-2019-134-05"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-09 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-09+-+Modicon+Quantum.pdf\u0026p_Doc_Ref=SEVD-2019-134-09"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-01 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-01+-+Pelco+Endura+NET55XX+Encoder.pdf\u0026p_Doc_Ref=SEVD-2019-134-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-04 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-04+-Schneider+Electric+Floating+License+Manager.pdf\u0026p_Doc_Ref=SEVD-2019-134-04"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-08 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-08+-+Modicon+Quantum.pdf\u0026p_Doc_Ref=SEVD-2019-134-08"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-03 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-03+-+Modicon+Controller.pdf\u0026p_Doc_Ref=SEVD-2019-134-03"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-02 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-02+-+Modicon+and+PacDrive+controllers.pdf\u0026p_Doc_Ref=SEVD-2019-134-02"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-07 du 14 mai 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-07+-+ConneXium+Gateway.pdf\u0026p_Doc_Ref=SEVD-2019-134-07"
}
]
}
CERTFR-2019-AVI-312
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | N/A | SCADAPack 300 E et 500 E series RTU (312E, 313E, 314E, 330E, 333E, 337E, 350E, 530E, 535E) | ||
| Schneider Electric | N/A | SCADAPack 57x RTU (570, 575) | ||
| Schneider Electric | N/A | SCADAPack 300 series RTU (314, 330, 334, 350) | ||
| Schneider Electric | Modicon M340 | Modicon M340 versions antérieures à V2.70 | ||
| Schneider Electric | N/A | Modicon M580 versions antérieures à V2.90 | ||
| Schneider Electric | N/A | Modicon Quantum versions antérieures à V3.12 | ||
| Schneider Electric | N/A | Interactive Graphical SCADA System (IGSS) versions antérieures à 13.0.0.19140 | ||
| Schneider Electric | N/A | Modicon M580 versions antérieures à V2.01 | ||
| Schneider Electric | N/A | Modicon Ethernet Module BMENOC0301 versions antérieures à V2.16 | ||
| Schneider Electric | Modicon M340 | Modicon M340 versions antérieures à V3.01 | ||
| Schneider Electric | N/A | Interactive Graphical SCADA System (IGSS) versions 14.x antérieures à 14.0.0.19120 | ||
| Schneider Electric | N/A | Modicon M221 | ||
| Schneider Electric | N/A | Zelio Soft 2 versions antérieures à v5.3 | ||
| Schneider Electric | N/A | Modicon Premium versions antérieures à V3.10 | ||
| Schneider Electric | N/A | SCADAPack 32 RTU | ||
| Schneider Electric | N/A | Control Expert versions antérieures à V14.0 sans le dernier correctif de sécurité | ||
| Schneider Electric | N/A | Modicon Momentum M1E 171CBU98090Modicon Momentum M1E 171CBU98091 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SCADAPack 300 E et 500 E series RTU (312E, 313E, 314E, 330E, 333E, 337E, 350E, 530E, 535E)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack 57x RTU (570, 575)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack 300 series RTU (314, 330, 334, 350)",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 versions ant\u00e9rieures \u00e0 V2.70",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 versions ant\u00e9rieures \u00e0 V2.90",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Quantum versions ant\u00e9rieures \u00e0 V3.12",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Interactive Graphical SCADA System (IGSS) versions ant\u00e9rieures \u00e0 13.0.0.19140",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M580 versions ant\u00e9rieures \u00e0 V2.01",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Ethernet Module BMENOC0301 versions ant\u00e9rieures \u00e0 V2.16",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 versions ant\u00e9rieures \u00e0 V3.01",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Interactive Graphical SCADA System (IGSS) versions 14.x ant\u00e9rieures \u00e0 14.0.0.19120",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M221",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Zelio Soft 2 versions ant\u00e9rieures \u00e0 v5.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Premium versions ant\u00e9rieures \u00e0 V3.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SCADAPack 32 RTU",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Control Expert versions ant\u00e9rieures \u00e0 V14.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon Momentum M1E 171CBU98090Modicon Momentum M1E 171CBU98091",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-6028",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6028"
},
{
"name": "CVE-2018-7846",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7846"
},
{
"name": "CVE-2019-6822",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6822"
},
{
"name": "CVE-2018-7842",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7842"
},
{
"name": "CVE-2018-7849",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7849"
},
{
"name": "CVE-2018-7838",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7838"
},
{
"name": "CVE-2019-6827",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6827"
},
{
"name": "CVE-2018-7854",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7854"
},
{
"name": "CVE-2018-7844",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7844"
},
{
"name": "CVE-2018-7847",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7847"
},
{
"name": "CVE-2019-6808",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6808"
},
{
"name": "CVE-2018-7850",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7850"
},
{
"name": "CVE-2018-7856",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7856"
},
{
"name": "CVE-2018-7845",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7845"
},
{
"name": "CVE-2018-7857",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7857"
},
{
"name": "CVE-2019-6807",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6807"
},
{
"name": "CVE-2019-6819",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6819"
},
{
"name": "CVE-2019-6806",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-6806"
},
{
"name": "CVE-2018-7853",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7853"
},
{
"name": "CVE-2018-7843",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7843"
},
{
"name": "CVE-2018-7848",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-7848"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-312",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-07-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-05 du 02 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-05-Modicon+Controllers-V1.1.pdf\u0026p_Doc_Ref=SEVD-2019-134-05"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-01 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-01-Zelio-Soft-2.pdf\u0026p_Doc_Ref=SEVD-2019-190-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2017-065-01 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2017-065-01-Modicon-SCADAPack-V2.0.pdf\u0026p_Doc_Ref=SEVD-2017-065-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-134-11 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-11-Modicon-Controllers-V1.1.pdf\u0026p_Doc_Ref=SEVD-2019-134-11"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-02 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-02-IGSS.pdf\u0026p_Doc_Ref=SEVD-2019-190-02"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-190-03 du 09 juillet 2019",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-190-03-Modicon-M580-Controller.pdf\u0026p_Doc_Ref=SEVD-2019-190-03"
}
]
}
GHSA-VF99-3R9R-PP36
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2022-05-24 16:46
VLAI?
Details
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.
Severity ?
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2019-6819"
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-22T20:29:00Z",
"severity": "HIGH"
},
"details": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.",
"id": "GHSA-vf99-3r9r-pp36",
"modified": "2022-05-24T16:46:17Z",
"published": "2022-05-24T16:46:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6819"
},
{
"type": "WEB",
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/109004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GSD-2019-6819
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-6819",
"description": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.",
"id": "GSD-2019-6819"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-6819"
],
"details": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.",
"id": "GSD-2019-6819",
"modified": "2023-12-13T01:23:49.988632Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@schneider-electric.com",
"ID": "CVE-2019-6819",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium",
"version": {
"version_data": [
{
"version_value": "Modicon Controllers, Modicon M340 - firmware versions prior to V3.01 Modicon M580 - firmware versions prior to V2.80 All firmware versions of Modicon Quantum and Modicon Premium"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-754: Improper Check for Unusual or Exceptional Conditions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/",
"refsource": "MISC",
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/"
},
{
"name": "109004",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/109004"
}
]
}
},
"nvd.nist.gov": {
"cve": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "606AFE88-8C9A-4D18-9209-1193B628669F",
"versionEndExcluding": "3.01",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "178D2338-E48E-493C-992F-337AACE794DE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "69222495-4F18-434E-B86C-F63C5A2C1242",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6D150239-27E2-4CBE-A931-5107C15E362F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:*:*:*:*:*:*:*",
"matchCriteriaId": "98212CF5-BCF4-4A55-B62A-484569687B4E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102cl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D30336F0-EDCF-486C-B52E-D0C53BCDFC65",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "99F2F851-C18F-4CB8-B47C-516F2AC7955D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56BAED8B-EEFA-45D7-A5A3-9B62067CE24C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:*:*:*:*:*:*:*",
"matchCriteriaId": "354968F7-C41B-4C21-8E47-81DC07DF0EA5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302cl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32091F91-9397-4506-8801-C68B9E8B60F0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "075A16D1-F4DF-4DCB-8DF9-152E282CE01F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6FDEB227-D50B-402C-9C11-E29F52BC10BB",
"versionEndExcluding": "2.80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh582040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4E6E5E62-BBA8-4370-A232-8E1196757C3E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh582040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C393EAE-D2A1-42BC-8CE8-2DCAC96EB769",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh584040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A8BF9D-AFD1-4F19-A0DB-5EB6F343D890",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh584040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "63D48211-A734-4F98-A4D5-569268335757",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh586040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38D22DD5-677B-42E8-AE1F-11601D4BF110",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh586040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79907FE7-B4B0-4732-9287-B7ED13115F6C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2317F260-7AA2-4178-B468-03DF36223E26",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D7DDC42-37A1-43B0-AD46-2E0D098564BA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "765E4FEE-255E-4C47-824A-5661B84B490B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B1FEA377-3C45-4F88-B233-088A24BD0771",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBCCDD6D-35CE-4680-8B0C-86584B1D8958",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68FD5968-C522-4231-A98C-93D3101B6148",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C02B27F6-B8CF-4D3B-9DA6-054F540EA6B6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBC38FF1-693E-4899-883C-1B7B80A52F2C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "002E7F33-6729-4C35-9DDA-7D8383BD5668",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "47DFEBAC-2F1D-4870-8425-2199BF80B425",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC4A1DF2-FF4C-4DBE-BF74-6A4A09E3DECE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6222C1F8-BE52-4666-B7F5-2E8BBC214F70",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5376D9F4-8AFB-4909-A11B-33C54C4220DB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CADB178B-FEFD-48A9-B155-0E8F6D490229",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6B3C1879-269B-47EB-891B-EF2E90C911D7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5771A1A5-3DAF-4869-A24F-F9B0A38B5DA5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:modicon_quantum_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "745CC7A7-70FB-4551-8EBF-600B7A6236D7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_quantum:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A9B7CEF7-B9BA-4923-808F-DA2931569EBB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:modicon_premium_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "619CFD8D-9652-4AAB-AFC4-796B3F10F61F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_premium:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F00936E2-E6EF-4ABF-8666-7D83BE424F42",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"descriptions": [
{
"lang": "en",
"value": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium."
},
{
"lang": "es",
"value": "Una CWE-754: Existe una vulnerabilidad de Comprobaci\u00f3n Inapropiada para condiciones inusuales o excepcionales, que podr\u00eda generar una posible Denegaci\u00f3n de Servicio cuando se env\u00edan tramas Modbus espec\u00edficas hacia el controlador en los productos: Modicon M340 - versiones de firmware anteriores a la V3.01, Modicon M580 - versiones de firmware anteriores a V2.80, y todas las versiones de firmware de Modicon Quantum y Modicon Premium."
}
],
"id": "CVE-2019-6819",
"lastModified": "2024-04-10T12:28:45.957",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-05-22T20:29:02.090",
"references": [
{
"source": "cybersecurity@se.com",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/109004"
},
{
"source": "cybersecurity@se.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/"
}
],
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-754"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-754"
}
],
"source": "cybersecurity@se.com",
"type": "Secondary"
}
]
}
}
}
}
CNVD-2019-15937
Vulnerability from cnvd - Published: 2019-05-30
VLAI Severity ?
Title
Modicon M580/M340/Premium/Quantum异常情况检查不当漏洞
Description
Modicon M340是一款复杂设备和中小型项目可编程控制器(PLC)。Modicon Premium是一款复杂控制可编程控制器(PLC)。Modicon Quantum是一款过程控制可编程控制器(PLC)。Modicon M580是一款可编程自动化控制器(PAC)。
Modicon M580/M340/Premium/Quantum存在异常情况检查不当漏洞。攻击者可通过发送特定Modbus帧利用该漏洞导致拒绝服务。
Severity
中
Patch Name
Modicon M580/M340/Premium/Quantum异常情况检查不当漏洞的补丁
Patch Description
Modicon M340是一款复杂设备和中小型项目可编程控制器(PLC)。Modicon Premium是一款复杂控制可编程控制器(PLC)。Modicon Quantum是一款过程控制可编程控制器(PLC)。Modicon M580是一款可编程自动化控制器(PAC)。
Modicon M580/M340/Premium/Quantum存在异常情况检查不当漏洞。攻击者可通过发送特定Modbus帧利用该漏洞导致拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布漏洞修复程序，请及时关注更新： https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-134-05+-+Modicon+Controller.pdf&p_Doc_Ref=SEVD-2019-134-05
Reference
https://web.nvd.nist.gov//vuln/detail/CVE-2019-6819
Impacted products
| Name | ['Schneider Electric Modicon M340 <V3.01', 'Schneider Electric Modicon Quantum', 'Schneider Electric Modicon Premium', 'Schneider Electric Modicon M580 <V2.80'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2019-6819",
"cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6819"
}
},
"description": "Modicon M340\u662f\u4e00\u6b3e\u590d\u6742\u8bbe\u5907\u548c\u4e2d\u5c0f\u578b\u9879\u76ee\u53ef\u7f16\u7a0b\u63a7\u5236\u5668(PLC)\u3002Modicon Premium\u662f\u4e00\u6b3e\u590d\u6742\u63a7\u5236\u53ef\u7f16\u7a0b\u63a7\u5236\u5668(PLC)\u3002Modicon Quantum\u662f\u4e00\u6b3e\u8fc7\u7a0b\u63a7\u5236\u53ef\u7f16\u7a0b\u63a7\u5236\u5668(PLC)\u3002Modicon M580\u662f\u4e00\u6b3e\u53ef\u7f16\u7a0b\u81ea\u52a8\u5316\u63a7\u5236\u5668(PAC)\u3002\n\nModicon M580/M340/Premium/Quantum\u5b58\u5728\u5f02\u5e38\u60c5\u51b5\u68c0\u67e5\u4e0d\u5f53\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7279\u5b9aModbus\u5e27\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
"discovererName": "Schneider Electric",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-05+-+Modicon+Controller.pdf\u0026p_Doc_Ref=SEVD-2019-134-05",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2019-15937",
"openTime": "2019-05-30",
"patchDescription": "Modicon M340\u662f\u4e00\u6b3e\u590d\u6742\u8bbe\u5907\u548c\u4e2d\u5c0f\u578b\u9879\u76ee\u53ef\u7f16\u7a0b\u63a7\u5236\u5668(PLC)\u3002Modicon Premium\u662f\u4e00\u6b3e\u590d\u6742\u63a7\u5236\u53ef\u7f16\u7a0b\u63a7\u5236\u5668(PLC)\u3002Modicon Quantum\u662f\u4e00\u6b3e\u8fc7\u7a0b\u63a7\u5236\u53ef\u7f16\u7a0b\u63a7\u5236\u5668(PLC)\u3002Modicon M580\u662f\u4e00\u6b3e\u53ef\u7f16\u7a0b\u81ea\u52a8\u5316\u63a7\u5236\u5668(PAC)\u3002\r\n\r\nModicon M580/M340/Premium/Quantum\u5b58\u5728\u5f02\u5e38\u60c5\u51b5\u68c0\u67e5\u4e0d\u5f53\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7279\u5b9aModbus\u5e27\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Modicon M580/M340/Premium/Quantum\u5f02\u5e38\u60c5\u51b5\u68c0\u67e5\u4e0d\u5f53\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"Schneider Electric Modicon M340 \u003cV3.01",
"Schneider Electric Modicon Quantum",
"Schneider Electric Modicon Premium",
"Schneider Electric Modicon M580 \u003cV2.80"
]
},
"referenceLink": "https://web.nvd.nist.gov//vuln/detail/CVE-2019-6819",
"serverity": "\u4e2d",
"submitTime": "2019-05-22",
"title": "Modicon M580/M340/Premium/Quantum\u5f02\u5e38\u60c5\u51b5\u68c0\u67e5\u4e0d\u5f53\u6f0f\u6d1e"
}
ICSA-19-183-01
Vulnerability from csaf_cisa - Published: 2019-07-02 00:00 - Updated: 2019-07-02 00:00Summary
Schneider Electric Modicon Controllers
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of this vulnerability could result in a denial-of-service condition.
Critical infrastructure sectors
Multiple Sectors
Countries/areas deployed
Worldwide
Company headquarters location
France
Recommended Practices
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
Exploitability
No known public exploits specifically target this vulnerability.
{
"document": {
"acknowledgments": [
{
"names": [
"Zhang Xiaoming",
"Zhang Jiawei",
"Sun Zhonghao",
"Luo bing"
],
"organization": "CNCERT/CC",
"summary": "reporting this vulnerability to NCCIC"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of this vulnerability could result in a denial-of-service condition.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Multiple Sectors",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "France",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nNCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "No known public exploits specifically target this vulnerability.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-19-183-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2019/icsa-19-183-01.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-19-183-01 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-19-183-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://ics-cert.us-cert.gov/tips/ICS-TIP-12-146-01B"
}
],
"title": "Schneider Electric Modicon Controllers",
"tracking": {
"current_release_date": "2019-07-02T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-19-183-01",
"initial_release_date": "2019-07-02T00:00:00.000000Z",
"revision_history": [
{
"date": "2019-07-02T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-19-183-01 Schneider Electric Modicon Controllers"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 3.01",
"product": {
"name": "Modicon M340: Firmware versions prior to v3.01",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "Modicon M340"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Modicon Quantum: all versions",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "Modicon Quantum"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Modicon Premium: all versions",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "Modicon Premium"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 2.80",
"product": {
"name": "Modicon M580: Firmware versions prior to v2.80",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "Modicon M580"
}
],
"category": "vendor",
"name": "Schneider Electric Software, LLC"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-6819",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"category": "summary",
"text": "An attacker could create a denial-of-service condition by sending a specific crafted Modbus frame to the affected device.CVE-2019-6819 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6819"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Schneider Electric has recommended the following to mitigate this vulnerability.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Modicon M340 - The vulnerability is fixed in v3.01 and is available for download ",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "BMXP3420302 and CL and H: https://www.schneider-electric.com/en/download/document/BMXP3420302_Firmwares/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/BMXP3420302_Firmwares/"
},
{
"category": "mitigation",
"details": "BMXP342020 and H: https://www.schneider-electric.com/en/download/document/BMXP342020_Firmwares/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/BMXP342020_Firmwares/"
},
{
"category": "mitigation",
"details": "BMXP342000: https://www.schneider-electric.com/en/download/document/BMXP342000_Firmwares/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/BMXP342000_Firmwares/"
},
{
"category": "mitigation",
"details": "BMXP341000 and H: https://www.schneider-electric.com/en/download/document/BMXP341000_Firmwares/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/BMXP341000_Firmwares/"
},
{
"category": "mitigation",
"details": "BMXP3420102 and CL: https://www.schneider-electric.com/en/download/document/BMXP3420102_Firmwares/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/BMXP3420102_Firmwares/"
},
{
"category": "mitigation",
"details": "BMXP3420302 and H: https://www.schneider-electric.com/en/download/document/BMXP3420302_Firmwares/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/BMXP3420302_Firmwares/"
},
{
"category": "vendor_fix",
"details": "Modicon M580 - The vulnerability is fixed in v2.80 ",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "BMEP584040, BMEP584040S, BMEH584040 and C: https://www.schneider-electric.com/en/download/document/M580_BMEP584040_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP584040_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP586040 and C: https://www.schneider-electric.com/en/download/document/M580_BMEP586040_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP586040_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEH586040 and C: https://www.schneiderelectric.com/en/download/document/M580_BMEH586040_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEH586040_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP581020 and H: https://www.schneiderelectric.com/en/download/document/M580_BMEP581020_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP581020_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP582020 and H: https://www.schneiderelectric.com/en/download/document/M580_BMEP582020_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP582020_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP582040 and H: https://www.schneiderelectric.com/en/download/document/M580_BMEP582040_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP582040_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP583020: https://www.schneiderelectric.com/en/download/document/M580_BMEP583020_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP583020_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP583040: https://www.schneiderelectric.com/en/download/document/M580_BMEP583040_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP583040_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP584020: https://www.schneiderelectric.com/en/download/document/M580_BMEP584020_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP584020_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP585040 and C: https://www.schneiderelectric.com/en/download/document/M580_BMEP585040_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP585040_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEP582040S: https://www.schneiderelectric.com/en/download/document/M580_BMEP582040S_SV2.80/",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP582040S_SV2.80/"
},
{
"category": "mitigation",
"details": "BMEH582040 and C: https://www.schneiderelectric.com/en/download/document/M580_BMEP582040_SV2.80",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://www.schneider-electric.com/en/download/document/M580_BMEP582040_SV2.80/"
},
{
"category": "vendor_fix",
"details": "Schneider Electric\u0027s Modicon Quantum controllers have reached the end of their life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, Schneider Electric\u0027s most current product. Schneider Electric recommends users migrate to the Modicon M580 ePAC.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "To mitigate risks associated with this Modbus vulnerability, users should immediately set up network segmentation and implement a firewall to block all unauthorized access to Port 502/TCP.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Locate control and safety system networks and remote devices behind firewalls, and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Physical controls should be in place so no unauthorized persons have access to the ICS and safety controllers, peripheral equipment, or the ICS and safety networks.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "All controllers should reside in locked cabinets and never be left in the \u201cProgram\u201d mode.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "All programming software should be kept in locked cabinets and should never be connected to any network other than the network for the intended devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "All methods of mobile data exchange with the isolated network (e.g., CDs, USB drives, etc.) should be scanned before use in the terminals or any node connected to these networks.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Laptops that have connected to any other network besides the intended network should never be allowed to connect to the safety or control networks without proper sanitation.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
},
{
"category": "mitigation",
"details": "For more information, please see Schneider Electric advisory: SEVD-2019-134-05",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
],
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-134-05+-+Modicon+Controller.pdf\u0026p_Doc_Ref=SEVD-2019-134-05"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004"
]
}
]
}
]
}
FKIE_CVE-2019-6819
Vulnerability from fkie_nvd - Published: 2019-05-22 20:29 - Updated: 2024-11-21 04:47
Severity ?
Summary
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "606AFE88-8C9A-4D18-9209-1193B628669F",
"versionEndExcluding": "3.01",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "178D2338-E48E-493C-992F-337AACE794DE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp341000h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "69222495-4F18-434E-B86C-F63C5A2C1242",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6D150239-27E2-4CBE-A931-5107C15E362F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102:-:*:*:*:*:*:*:*",
"matchCriteriaId": "98212CF5-BCF4-4A55-B62A-484569687B4E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420102cl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D30336F0-EDCF-486C-B52E-D0C53BCDFC65",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "99F2F851-C18F-4CB8-B47C-516F2AC7955D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56BAED8B-EEFA-45D7-A5A3-9B62067CE24C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:*:*:*:*:*:*:*",
"matchCriteriaId": "354968F7-C41B-4C21-8E47-81DC07DF0EA5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302cl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32091F91-9397-4506-8801-C68B9E8B60F0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "075A16D1-F4DF-4DCB-8DF9-152E282CE01F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6FDEB227-D50B-402C-9C11-E29F52BC10BB",
"versionEndExcluding": "2.80",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh582040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4E6E5E62-BBA8-4370-A232-8E1196757C3E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh582040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C393EAE-D2A1-42BC-8CE8-2DCAC96EB769",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh584040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A8BF9D-AFD1-4F19-A0DB-5EB6F343D890",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh584040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "63D48211-A734-4F98-A4D5-569268335757",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh586040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "38D22DD5-677B-42E8-AE1F-11601D4BF110",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:bmeh586040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79907FE7-B4B0-4732-9287-B7ED13115F6C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep581020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2317F260-7AA2-4178-B468-03DF36223E26",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep581020h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D7DDC42-37A1-43B0-AD46-2E0D098564BA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "765E4FEE-255E-4C47-824A-5661B84B490B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582020h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B1FEA377-3C45-4F88-B233-088A24BD0771",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBCCDD6D-35CE-4680-8B0C-86584B1D8958",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68FD5968-C522-4231-A98C-93D3101B6148",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep582040s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C02B27F6-B8CF-4D3B-9DA6-054F540EA6B6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep583020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BBC38FF1-693E-4899-883C-1B7B80A52F2C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep583040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "002E7F33-6729-4C35-9DDA-7D8383BD5668",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "47DFEBAC-2F1D-4870-8425-2199BF80B425",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC4A1DF2-FF4C-4DBE-BF74-6A4A09E3DECE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6222C1F8-BE52-4666-B7F5-2E8BBC214F70",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep585040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5376D9F4-8AFB-4909-A11B-33C54C4220DB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep585040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CADB178B-FEFD-48A9-B155-0E8F6D490229",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6B3C1879-269B-47EB-891B-EF2E90C911D7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5771A1A5-3DAF-4869-A24F-F9B0A38B5DA5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:modicon_quantum_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "745CC7A7-70FB-4551-8EBF-600B7A6236D7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_quantum:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A9B7CEF7-B9BA-4923-808F-DA2931569EBB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:modicon_premium_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "619CFD8D-9652-4AAB-AFC4-796B3F10F61F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:modicon_premium:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F00936E2-E6EF-4ABF-8666-7D83BE424F42",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium."
},
{
"lang": "es",
"value": "Una CWE-754: Existe una vulnerabilidad de Comprobaci\u00f3n Inapropiada para condiciones inusuales o excepcionales, que podr\u00eda generar una posible Denegaci\u00f3n de Servicio cuando se env\u00edan tramas Modbus espec\u00edficas hacia el controlador en los productos: Modicon M340 - versiones de firmware anteriores a la V3.01, Modicon M580 - versiones de firmware anteriores a V2.80, y todas las versiones de firmware de Modicon Quantum y Modicon Premium."
}
],
"id": "CVE-2019-6819",
"lastModified": "2024-11-21T04:47:12.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-05-22T20:29:02.090",
"references": [
{
"source": "cybersecurity@se.com",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/109004"
},
{
"source": "cybersecurity@se.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.securityfocus.com/bid/109004"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05/"
}
],
"sourceIdentifier": "cybersecurity@se.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-754"
}
],
"source": "cybersecurity@se.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-754"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…