CVE-2019-6843

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-6843
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the controller with an empty firmware package using FTP protocol.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://www.se.com/ww/en/download/document/SEVD-2019-281-02/ Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:modicon_m580:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:schneider-electric:modicon_bmxcra_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:modicon_bmxcra:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:schneider-electric:modicon_140cra_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:schneider-electric:modicon_140cra:-:*:*:*:*:*:*:*
History

03 Feb 2022, 15:58

Type Values Removed Values Added
First Time Schneider-electric modicon M340
CPE cpe:2.3:h:se:modicon_m340:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*

14 Sep 2021, 12:07

Type Values Removed Values Added
CPE cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:* cpe:2.3:h:se:modicon_m340:-:*:*:*:*:*:*:*
References (MISC) https://www.se.com/ww/en/download/document/SEVD-2019-281-02/ - (MISC) https://www.se.com/ww/en/download/document/SEVD-2019-281-02/ - Vendor Advisory

19 Apr 2021, 13:15

Type Values Removed Values Added
References
  • {'url': 'https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02', 'name': 'https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02', 'tags': ['Vendor Advisory'], 'refsource': 'CONFIRM'}
  • (MISC) https://www.se.com/ww/en/download/document/SEVD-2019-281-02/ -
Summary A CWE-248: Uncaught Exception vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the controller with an empty firmware package using FTP protocol. A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the controller with an empty firmware package using FTP protocol.
Information

Published : 2019-10-29 19:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-6843

Mitre link : CVE-2019-6843

CVE.ORG link : CVE-2019-6843

JSON object : View

Products Affected

schneider-electric

  • modicon_m580_firmware
  • modicon_140cra
  • modicon_bmxcra
  • modicon_140cra_firmware
  • modicon_m340
  • modicon_m580
  • modicon_m340_firmware
  • modicon_bmxcra_firmware
CWE
CWE-755

Improper Handling of Exceptional Conditions