Code injection

In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Service when using Modbus protocol...

CVE-2018-7788

A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when using a Telnet connection...

Out-of-bounds

A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus...

Information disclosure

A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus...

Design/Logic Flaw

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus...

Design/Logic Flaw

A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when using a Telnet connection...

Design/Logic Flaw

A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller...

CVE-2019-6808

The CVE-2019-6808 issue affects Schneider Electric Modicon controllers (M580, M340, Quantum, Premium). It is a CWE-284 improper access control vulnerability that could allow remote code execution by overwriting configuration settings over Modbus. Affected components include the controller’s confi...

CVE-2019-6807

CVE-2019-6807 affects Schneider Electric Modicon M580, M340, Quantum, and Premium PLCs. The issue is an Uncaught Exception (CWE-248) that could cause denial of service when writing sensitive application variables to the controller over Modbus. Connected sources confirm the vulnerability across al...

CVE-2019-6806

Schneider Electric Modicon M580, M340, Quantum, and Premium PLCs are affected by CVE-2019-6806, a CWE-200 information-exposure vulnerability. The issue stems from UMAS/Modbus read paths that can disclose SNMP information, including read/write/trap SNMP strings, when reading variables in the contr...

CVE-2018-7857

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus...

CVE-2018-7856

The CVE-2018-7856 entry concerns Schneider Electric Modicon PLCs (M580, M340, Quantum, Premium). The vulnerability is a CWE-248 Uncaught Exception leading to potential denial of service when writing invalid memory blocks to the controller over Modbus. Affected software/hardware is the Modicon fam...

CVE-2018-7855

CVE-2018-7855 affects Schneider Electric Modicon M580, M340, Quantum and Premium PLCs. The root cause is an uncaught exception when handling invalid breakpoint parameters sent over Modbus, which can trigger a Denial of Service with partial availability impact. Connected documents confirm the affe...

CVE-2018-7854

CVE-2018-7854 affects Schneider Electric Modicon M580, M340, Quantum, and Premium PLCs. The issue is a CWE-248 Uncaught Exception that can cause denial of service when invalid debug parameters are sent over Modbus. The provided documents confirm affected models and the root cause (uncaught except...

CVE-2018-7852

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus...

CVE-2018-7845

CVE-2018-7845 affects Schneider Electric Modicon M580, M340, Quantum, and Premium PLCs. The vulnerability is CWE-125: Out-of-bounds Read, allowing disclosure of unexpected data when reading specific memory blocks over Modbus. Impact is data disclosure; no exploitation details are provided in the ...

CVE-2018-7850

CVE-2018-7850 affects Schneider Electric Modicon controllers (M580, M340, Quantum, Premium) and relates to CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The vulnerability could cause invalid information displayed in Unity Pro software due to a trust boundary issue in input handli...

CVE-2018-7847

CVE-2018-7847 affects Schneider Electric Modicon M580/M340/Quantum/Premium PLCs via Modbus; Talos confirms an unauthenticated UMAS file-write vulnerability in Modicon M580 firmware SV2.70 that can overwrite the device strategy/configuration, potentially enabling code execution and wide impact. Th...

CVE-2018-7842

The CVE-2018-7842 issue affects Schneider Electric Modicon M580, M340, Quantum, and Premium PLCs. Root cause: CWE-290 Authentication Bypass by Spoofing enabling brute-forcing of Modbus parameters to gain elevated privileges. Impact: elevation of privilege and potential unauthorized control of dev...

CVE-2018-7848

CVE-2018-7848 is an information-disclosure flaw in Schneider Electric Modicon controllers (M580, M340, Quantum, Premium) exploitable via the UMAS strategy read path. A specially crafted UMAS read of the programmed strategy (function code 0x34) can reveal plaintext SNMP community strings and other...