CVE-2018-7838
High
Description
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSchneider-electric Bmenoc0301 Firmware
PublishedJul 15, 2019
First seenJul 15, 2019
Weakness typeCWE-119Memory buffer bounds error
How to fix
Update
- schneider-electric bmenoc0301_firmware2.16 or later
- schneider-electric modicon_m580_bmep584040_firmware2.90 or later
- schneider-electric modicon_m580_bmep586040_firmware2.90 or later
- schneider-electric bmeh586040_firmware2.90 or later
- schneider-electric modicon_m580_bmep581020_firmware2.90 or later
- schneider-electric modicon_m580_bmep582020_firmware2.90 or later
- schneider-electric modicon_m580_bmep582040_firmware2.90 or later
- schneider-electric modicon_m580_bmep583020_firmware2.90 or later
- schneider-electric modicon_m580_bmep583040_firmware2.90 or later
- schneider-electric modicon_m580_bmep584020_firmware2.90 or later
- schneider-electric modicon_m580_bmep585040_firmware2.90 or later
- schneider-electric modicon_m580_bmep582040s_firmware2.90 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric bmenoc0301_firmware | v < 2.16 | 2.16 |
| schneider-electric modicon_m580_bmep584040_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep586040_firmware | v < 2.90 | 2.90 |
| schneider-electric bmeh586040_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep581020_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep582020_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep582040_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep583020_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep583040_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep584020_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep585040_firmware | v < 2.90 | 2.90 |
| schneider-electric modicon_m580_bmep582040s_firmware | v < 2.90 | 2.90 |
| schneider-electric bmeh582040_firmware | v < 2.90 | 2.90 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.