Schneider Electric Modicon M580 UMAS Read Memory Block Out Of Bounds Information Disclosure Vulnerability

🗓️ 10 Jun 2019 00:00:00Reported by Talos IntelligenceType

talos🔗 www.talosintelligence.com👁 933 Views

An out of bounds information disclosure vulnerability exists in Schneider Electric Modicon M580 programmable automation controller due to the UMAS memory block read functionality. Attackers can exploit this vulnerability to trigger an out of bounds read and disclose sensitive information via specially crafted UMAS requests

Reporter	Title	Published	Views	Family All 34
BDU FSTEC	The vulnerability of the microprogrammed programmable logic controller Modicon, related to reading buffers from external sources, allows a intruder to disclose protected information.	14 Jun 201900:00	–	bdu_fstec
Circl	CVE-2018-7845	24 Apr 202510:00	–	circl
CNVD	Buffer Overflow Vulnerability in Multiple Schneider Electric Products (CNVD-2019-34829)	23 May 201900:00	–	cnvd
Check Point Advisories	Schneider Electric Modicon Multiple Information Disclosure Vulnerabilities (CVE-2018-7844; CVE-2018-7845; CVE-2019-6806)	7 Jul 201900:00	–	checkpoint_advisories
CVE	CVE-2018-7845	22 May 201920:00	–	cve
Cvelist	CVE-2018-7845	22 May 201920:00	–	cvelist
EUVD	EUVD-2018-19557	7 Oct 202500:30	–	euvd
NVD	CVE-2018-7845	22 May 201920:29	–	nvd
Tenable Nessus	Schneider-electric Modicon Out-of-bounds Read	8 Nov 201900:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Controllers Authentication Bypass By Spoofing (CVE-2018-7842)	7 Feb 202200:00	–	nessus