CVE-2019-6828
published 2019-09-17CVE-2019-6828: A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.53%
71.7th percentile
A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Premium (all versions), and Modicon Quantum (all versions), which could cause a possible denial of service when reading specific coils and registers in the controller over Modbus.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| schneider-electric | modicon_m340_firmware | < 3.10 | 3.10 |
| schneider-electric | modicon_m580_firmware | < 2.90 | 2.90 |
| schneider_electric_se | modicon_m340 | — | — |
| schneider_electric_se | modicon_m580 | — | — |
| schneider_electric_se | modicon_premium | — | — |
| schneider_electric_se | modicon_quantum | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Schneider Electric Modicon Controllers
cisa_ics·2025-04-24·CVSS 9.8
[CRITICAL] Schneider Electric Modicon Controllers
ICS Advisory
##
Schneider Electric Modicon Controllers
Release DateApril 24, 2025
Alert CodeICSA-25-114-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Schneider Electric
- Equipment: Modicon M580, Modicon M340, Modicon Premium, and Modicon Quantum
- Vulnerabilities: Trust Boundary Violation, Uncaught Exception, Exposure of Sensitive Information to an Unauthorized Actor, Authentication Bypass by Spoofing, Improper Access Control, Reliance on Untrusted Inputs in a Security Decision, Out-of-bounds Read
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities may risk execution of unsolici
GHSA
GHSA-4ffv-765j-gvf6: A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2
ghsa_unreviewed·2022-05-24
CVE-2019-6828 [HIGH] CWE-755 GHSA-4ffv-765j-gvf6: A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2
A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Premium (all versions), and Modicon Quantum (all versions), which could cause a possible denial of service when reading specific coils and registers in the controller over Modbus.
No detection rules found.
No public exploits indexed.
2019-09-17
Published