SB2020011706 - Multiple vulnerabilities in Schneider Electric Modicon Controllers

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2018-7794)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper check for unusual or exceptional conditions. A remote attacker can cause a denial of service condition when reading data with invalid index using Modbus TCP.

2) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2019-6856)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper check for unusual or exceptional conditions. A remote attacker can cause a denial of service condition when writing specific physical memory blocks using Modbus TCP.

Remediation

Install update from vendor's website.

References

• https://www.se.com/ww/en/download/document/SEVD-2019-344-01