Main Vulnerability Database Vulnerabilities #VU21501

Information disclosure in Schneider Electric products - CVE-2018-7848

Published: October 3, 2019

Vulnerability identifier: #VU21501

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7848

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper input validation. A remote attacker can gain unauthorized access to SNMP information when reading files from the controller over Modbus.

Affected software

Modicon Quantum
Modicon Premium
Modicon M340
Modicon M580

How to mitigate CVE-2018-7848

Install updates from vendor's website.

Modicon M340 - update to 3.10
Modicon M580 - update to 2.90

External References

Related Security Bulletins