CVE-2018-7824

The CVE-2018-7824 entry concerns Schneider Electric Modbus Serial Driver. Affected components are the Modbus Serial Driver for 64‑bit Windows (V3.17 IE37 and prior) and 32‑bit Windows (V2.17 IE27 and prior), including the Driver Suite (V14.12 and prior). The vulnerability is an External Control o...

Modicon M580/M340/Premium/Quantum Improper Exception Checking Vulnerability

Modicon M340 is a programmable controller PLC for complex devices and small to medium-sized projects.Modicon Premium is a programmable controller PLC for complex control.Modicon Quantum is a programmable controller PLC for process control.Modicon M580 is a programmable automation controller PAC...

CVE-2018-7847: Improper Authentication

A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus...

CVE-2018-7851: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware prior to V2.40, All firmware versions of Modicon Premium and 140CRA312xxx when sending a specially crafted Modbus packet, which could caus...

CVE-2018-7849: Improper Handling of Exceptional Conditions

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending files the controller over Modbus...

CVE-2018-7855: Improper Check for Unusual or Exceptional Conditions

A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus...

CVE-2018-7842: Authentication Bypass by Spoofing

A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller...

CVE-2019-6806: Undefined Security Weakness

A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus...

CVE-2019-6808: Missing Authentication for Critical Function

A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus...

CVE-2019-6819: Improper Check for Unusual or Exceptional Conditions

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to...

CVE-2018-7857: Improper Check for Unusual or Exceptional Conditions

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus...

PT-2019-11106

Name of the Vulnerable Software and Affected Versions: Modicon M580 affected versions not specified Modicon M340 affected versions not specified Modicon Quantum affected versions not specified Modicon Premium affected versions not specified Description: A denial of service issue exists due to an...

CVE-2018-7845: Out-of-bounds Read

A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus...

CVE-2018-7846: Exposure of Resource to Wrong Sphere

A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller...

CVE-2018-7852: Improper Handling of Exceptional Conditions

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus...

CVE-2018-7853: Improper Check for Unusual or Exceptional Conditions

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus...

CVE-2019-6807: Improper Handling of Exceptional Conditions

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of service when writing sensitive application variables to the controller over Modbus...

CVE-2019-6816: Improper Control of Generation of Code

In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Service when using Modbus protocol...

CVE-2018-7854: Improper Check for Unusual or Exceptional Conditions

A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service when sending invalid debug parameters to the controller over Modbus...

CVE-2018-7824: Externally Controlled Reference to a Resource in Another Sphere

An Externally Controlled Reference to a Resource CWE-610 vulnerability exists in Schneider Electric Modbus Serial Driver For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior which could allow write acce...