Vulnerabilities > CVE-2018-7846 - Exposure of Resource to Wrong Sphere vulnerability in Schneider-Electric products

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
schneider-electric
CWE-668
critical
NVD
Published: 2019-05-22
Updated: 2022-02-03

Summary

A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller.

Vulnerable Configurations

Part Description Count
OS
Schneider-Electric
4
Hardware
Schneider-Electric
4

Common Weakness Enumeration (CWE)

Talos

idTALOS-2018-0735
last seen2019-06-10
published2019-06-10
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0735
titleSchneider Electric Modicon M580 UMAS release reservation denial-of-service vulnerability

References