Lucene search

SchneiderCVE-2018-7838

HistoryJul 15, 2019 - 9:15 p.m.

CVE-2018-7838

2019-07-1521:15:10

CWE-119

schneider

web.nvd.nist.gov

133

cve-2018-7838

cwe-119

buffer errors

modicon m580 cpu

bmep582040

bmenoc0301

v2.90

v2.16

ftp service

denial of service

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

42.5%

JSON

A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.

Affected configurations

Nvd

Node

schneider-electricbmenoc0301_firmwareRange<2.16

AND

schneider-electricbmenoc0301Match-

Node

schneider-electricmodicon_m580_bmep584040_firmwareRange<2.90

AND

schneider-electricbmeh584040Match-

schneider-electricbmeh584040cMatch-

schneider-electricmodicon_m580_bmep584040Match-

schneider-electricmodicon_m580_bmep584040sMatch-

Node

schneider-electricmodicon_m580_bmep586040_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep586040Match-

schneider-electricmodicon_m580_bmep586040cMatch-

Node

schneider-electricbmeh586040_firmwareRange<2.90

AND

schneider-electricbmeh586040Match-

schneider-electricbmeh586040cMatch-

Node

schneider-electricmodicon_m580_bmep581020_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep581020Match-

schneider-electricmodicon_m580_bmep581020hMatch-

Node

schneider-electricmodicon_m580_bmep582020_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep582020Match-

schneider-electricmodicon_m580_bmep582020hMatch-

Node

schneider-electricmodicon_m580_bmep582040_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep582040Match-

schneider-electricmodicon_m580_bmep582040hMatch-

Node

schneider-electricmodicon_m580_bmep583020_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep583020Match-

Node

schneider-electricmodicon_m580_bmep583040_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep583040Match-

Node

schneider-electricmodicon_m580_bmep584020_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep584020Match-

Node

schneider-electricmodicon_m580_bmep585040_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep585040Match-

schneider-electricmodicon_m580_bmep585040cMatch-

Node

schneider-electricmodicon_m580_bmep582040s_firmwareRange<2.90

AND

schneider-electricmodicon_m580_bmep582040sMatch-

Node

schneider-electricbmeh582040_firmwareRange<2.90

AND

schneider-electricbmeh582040Match-

schneider-electricbmeh582040cMatch-

VendorProductVersionCPE
schneider-electricbmenoc0301_firmware*cpe:2.3:o:schneider-electric:bmenoc0301_firmware:*:*:*:*:*:*:*:*
schneider-electricbmenoc0301-cpe:2.3:h:schneider-electric:bmenoc0301:-:*:*:*:*:*:*:*
schneider-electricmodicon_m580_bmep584040_firmware*cpe:2.3:o:schneider-electric:modicon_m580_bmep584040_firmware:*:*:*:*:*:*:*:*
schneider-electricbmeh584040-cpe:2.3:h:schneider-electric:bmeh584040:-:*:*:*:*:*:*:*
schneider-electricbmeh584040c-cpe:2.3:h:schneider-electric:bmeh584040c:-:*:*:*:*:*:*:*
schneider-electricmodicon_m580_bmep584040-cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:*:*:*:*:*:*:*
schneider-electricmodicon_m580_bmep584040s-cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:*:*:*:*:*:*:*
schneider-electricmodicon_m580_bmep586040_firmware*cpe:2.3:o:schneider-electric:modicon_m580_bmep586040_firmware:*:*:*:*:*:*:*:*
schneider-electricmodicon_m580_bmep586040-cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:*:*:*:*:*:*:*
schneider-electricmodicon_m580_bmep586040c-cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	bmenoc0301_firmware	*	cpe:2.3:o:schneider-electric:bmenoc0301_firmware::::::::
schneider-electric	bmenoc0301	-	cpe:2.3:h:schneider-electric:bmenoc0301:-:::::::*
schneider-electric	modicon_m580_bmep584040_firmware	*	cpe:2.3:o:schneider-electric:modicon_m580_bmep584040_firmware::::::::
schneider-electric	bmeh584040	-	cpe:2.3:h:schneider-electric:bmeh584040:-:::::::*
schneider-electric	bmeh584040c	-	cpe:2.3:h:schneider-electric:bmeh584040c:-:::::::*
schneider-electric	modicon_m580_bmep584040	-	cpe:2.3:h:schneider-electric:modicon_m580_bmep584040:-:::::::*
schneider-electric	modicon_m580_bmep584040s	-	cpe:2.3:h:schneider-electric:modicon_m580_bmep584040s:-:::::::*
schneider-electric	modicon_m580_bmep586040_firmware	*	cpe:2.3:o:schneider-electric:modicon_m580_bmep586040_firmware::::::::
schneider-electric	modicon_m580_bmep586040	-	cpe:2.3:h:schneider-electric:modicon_m580_bmep586040:-:::::::*
schneider-electric	modicon_m580_bmep586040c	-	cpe:2.3:h:schneider-electric:modicon_m580_bmep586040c:-:::::::*

Rows per page:

1-10 of 361

CNA Affected

[
  {
    "product": "Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16",
    "vendor": "Modicon",
    "versions": [
      {
        "status": "affected",
        "version": "Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16"
      }
    ]
  }
]

References

www.schneider-electric.com/ww/en/download/document/SEVD-2019-190-03

Social References

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

42.5%

JSON

Related for CVE-2018-7838