CVE-2018-7857
First published: Wed May 22 2019(Updated: )
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus.
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider Electric Modicon Premium | <3.20 | |
| Schneider Electric Modicon Premium | ||
| Schneider Electric Modicon Quantum Firmware | <3.60 | |
| Schneider Electric Modicon Quantum | ||
| Schneider Electric Modicon M340 Firmware | <3.01 | |
| Schneider Electric Modicon M340 | ||
| Schneider Electric Modicon M580 Firmware | <2.80 | |
| Schneider Electric Modicon M580 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-7857?
CVE-2018-7857 is a vulnerability that exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus.
Which software versions are affected by CVE-2018-7857?
CVE-2018-7857 affects all versions of Schneider-electric Modicon Premium Firmware up to version 3.20, Modicon Quantum Firmware up to version 3.60, Modicon M340 Firmware up to version 3.01, and Modicon M580 Firmware up to version 2.80.
What is the severity of CVE-2018-7857?
CVE-2018-7857 has a severity rating of 7.5 (high).
How can CVE-2018-7857 be exploited?
CVE-2018-7857 can be exploited by writing out of bounds variables to the controller over Modbus.
How can I fix CVE-2018-7857?
To fix CVE-2018-7857, update the affected products to the latest firmware version provided by Schneider-electric.
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/schneider-electric
- canonical/schneider electric modicon premium
- canonical/schneider electric modicon quantum firmware
- canonical/schneider electric modicon quantum
- canonical/schneider electric modicon m340 firmware
- canonical/schneider electric modicon m340
- canonical/schneider electric modicon m580 firmware
- canonical/schneider electric modicon m580