CVE-2018-7838

published 2019-07-15

CVE-2018-7838: A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions…

Priority P3 36 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
modicon	modicon_m580_cpu_bmep582040_all_versions_before_v2.90_and_modicon_ethernet_modul	—	—
schneider-electric	bmeh582040_firmware	< 2.90	2.90
schneider-electric	bmeh586040_firmware	< 2.90	2.90
schneider-electric	bmenoc0301_firmware	< 2.16	2.16
schneider-electric	modicon_m580_bmep581020_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep582020_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep582040_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep582040s_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep583020_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep583040_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep584020_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep584040_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep585040_firmware	< 2.90	2.90
schneider-electric	modicon_m580_bmep586040_firmware	< 2.90	2.90

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 7.8 HIGH AV:N/AC:L/Au:N/C:N/I:N/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119