Uncaught Exception in Schneider Electric products - CVE-2018-7843
Published: October 3, 2019
Vulnerability identifier: #VU21496
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-7843
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service (DoS) condition on the target system.
The vulnerability exists due to uncaught exception vulnerability when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus. A remote attacker can cause a denial of service condition.
The vulnerability exists due to uncaught exception vulnerability when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus. A remote attacker can cause a denial of service condition.
Affected software
Modicon Quantum
Modicon Premium
Modicon M340
Modicon M580
Modicon Premium
Modicon M340
Modicon M580
How to mitigate CVE-2018-7843
Install updates from vendor's website.
Modicon M340 - update to 3.10
Modicon M580 - update to 2.80
Modicon M580 - update to 2.80