CVE-2018-7845

CVE-2018-7845 affects Schneider Electric Modicon M580, M340, Quantum, and Premium PLCs. The vulnerability is CWE-125: Out-of-bounds Read, allowing disclosure of unexpected data when reading specific memory blocks over Modbus. Impact is data disclosure; no exploitation details are provided in the ...

CVE-2018-7850

CVE-2018-7850 affects Schneider Electric Modicon controllers (M580, M340, Quantum, Premium) and relates to CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The vulnerability could cause invalid information displayed in Unity Pro software due to a trust boundary issue in input handli...

CVE-2018-7847

CVE-2018-7847 affects Schneider Electric Modicon M580/M340/Quantum/Premium PLCs via Modbus; Talos confirms an unauthenticated UMAS file-write vulnerability in Modicon M580 firmware SV2.70 that can overwrite the device strategy/configuration, potentially enabling code execution and wide impact. Th...

CVE-2018-7842

The CVE-2018-7842 issue affects Schneider Electric Modicon M580, M340, Quantum, and Premium PLCs. Root cause: CWE-290 Authentication Bypass by Spoofing enabling brute-forcing of Modbus parameters to gain elevated privileges. Impact: elevation of privilege and potential unauthorized control of dev...

CVE-2018-7848

CVE-2018-7848 is an information-disclosure flaw in Schneider Electric Modicon controllers (M580, M340, Quantum, Premium) exploitable via the UMAS strategy read path. A specially crafted UMAS read of the programmed strategy (function code 0x34) can reveal plaintext SNMP community strings and other...

CVE-2018-7843

CVE-2018-7843 concerns Schneider Electric Modicon PLCs (M580, M340, Quantum, Premium) with a flaw in the UMAS memory block read path over Modbus. The public Talos analysis describes an out-of-bounds memory read in the MEMORY_BLOCK_READ function that can trigger a non-recoverable fault, potentiall...

CVE-2018-7849

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending files the controller over Modbus...

CVE-2018-7849

The CVE-2018-7849 vulnerability affects Schneider Electric Modicon M580, M340, Quantum and Premium PLCs. A CWE-248 Uncaught Exception could trigger a Denial of Service due to improper data integrity checks when sending files via Modbus. Affected firmware observed in Modicon M580 SV2.70 (e.g., BME...

CVE-2018-7846

CVE-2018-7846 affects Schneider Electric Modicon M580, M340, Quantum and Premium PLCs. The issue is a CWE-501 Trust Boundary Violation in the UMAS/Reservation mechanism: an unauthenticated brute-force attempt to the Modbus-based reservation session (one-byte session token) can allow unauthorized ...

CVE-2019-6816

In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Service when using Modbus protocol...

CVE-2019-6816

The CVE-2019-6816 entry concerns Schneider Electric Modicon Quantum controllers. A CWE-94 Code Injection flaw exists in all firmware versions, enabling unauthorized firmware modification and potential Denial of Service when operating over Modbus. The publicly documented impact is partial integrit...

CVE-2019-6815

The CVE-2019-6815 entry concerns Modicon Quantum PLCs (all firmware versions) with CWE-264 (Permissions, Privileges, and Access Control). The vulnerability arises via Ethernet/IP, enabling denial of service or unauthorized modifications of the PLC configuration due to improper access control. Doc...

CVE-2019-6815

In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could cause a denial of service or unauthorized modifications of the PLC configuration when using Ethernet/IP protocol...

CVE-2018-7788

A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when using a Telnet connection...

CVE-2018-7788

CVE-2018-7788 affects Schneider Electric Modicon Quantum firmware prior to V2.40, due to a CWE-255 Credentials Management vulnerability that could yield a Denial of Service when using Telnet. Affects Modicon Quantum products with older firmware; remediation is to upgrade to V2.40 or later per SEV...

CVE-2019-6819

Schneider Electric Modicon M340 (pre-3.01), M580 (pre-2.80), and all Modicon Quantum and Premium firmware are affected by CVE-2019-6819 (CWE-754). A remote attacker can cause a denial-of-service by sending specially crafted Modbus frames. The Red Hat, Tenable OT, and CISA/ICS advisories corrobora...

CVE-2019-6819

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to...

CVE-2019-6821

CVE-2019-6821 affects Schneider Electric Modicon devices: M580 firmware versions before 2.30 (and M580 M340/Premium/Quantum family). The vulnerability is CWE-330: Use of Insufficiently Random Values, causing predictable TCP initial sequence numbers that can enable an attacker to hijack TCP connec...

CVE-2019-6821

CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum...

Denial of Service Vulnerability in Multiple Schneider Electric Products (CNVD-2019-15891)

The Schneider Electric Modicon M580 is a programmable automation controller.The Schneider Electric Modicon Premium is a large programmable logic controller PLC for discrete or process applications.The Schneider Electric Modicon Quantum is a large programmable logic controller PLC for process...