Schneider Electric Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200

🗓️ 27 Mar 2018 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 52 Views

Schneider Electric Modicon PLCs affected by stack-based buffer overflow, hard-coded credentials, and risky cryptographic algorithm vulnerabilities. Remotely exploitable, low skill level

Reporter	Title	Published	Views	Family All 31
Tenable Nessus	Schneider Electric Modicon Quantum Buffer Overflow	8 May 201900:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Multiple Controllers Hardcoded Credentials	8 May 201900:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Multiple Controllers Weak Encryption Algorithm	8 May 201900:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200 Stack-Based Buffer Overflow (CVE-2018-7240)	29 Jun 202300:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200 Use of Hard-Coded Credentials (CVE-2018-7241)	29 Jun 202300:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200 Use of a Broken or Risky Cryptographic Algorithm (CVE-2018-7242)	29 Jun 202300:00	–	nessus
BDU FSTEC	The vulnerability of FTP servers of microprogrammed software-controlled Schneider Electric Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200 allows a intruder to gain access to the devices.	14 Jun 201800:00	–	bdu_fstec
BDU FSTEC	The vulnerability of FTP servers of microprogrammed logic controllers from Schneider Electric—Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200—allows attackers to select passwords.	5 Oct 201800:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the FTP server of the microprogramming software for Schneider Electric Modicon Quantum control devices arises from deficiencies in access control. This allows a intruder to execute arbitrary code, cause system failures, or upload malicious firmware.	5 Oct 201800:00	–	bdu_fstec
CNVD	Weak Encryption Algorithm Vulnerability in Various Schneider Electric Products	28 Mar 201800:00	–	cnvd

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2018/icsa-18-086-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-18-086-01
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/

27 Mar 2018 00:00Current

10High risk

Vulners AI Score10

CVSS 210

CVSS 39.8

EPSS0.00552