CVE-2018-7794 : A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability ex

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service when reading data with invalid index using Modbus TCP.

Published 2020-01-06 23:15:11

Updated 2022-02-03 14:31:18

Source Schneider Electric SE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2018-7794

Schneider-electric » 140cpu65150 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu65150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu65150 » Version: N/A
Schneider-electric » 140cpu65160 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu65160_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu65160 » Version: N/A
Schneider-electric » 140cpu65260 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu65260_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu65260 » Version: N/A
Schneider-electric » 140cpu65860 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu65860_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu65860 » Version: N/A
Schneider-electric » 140cpu65160s Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu65160s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu65160s » Version: N/A
Schneider-electric » Tsxh5724m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxh5724m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxh5724m » Version: N/A
Schneider-electric » Tsxh5744m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxh5744m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxh5744m » Version: N/A
Schneider-electric » Tsxp57104m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp57104m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp57104m » Version: N/A
Schneider-electric » Tsxp57154m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp57154m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp57154m » Version: N/A
Schneider-electric » Tsxp571634m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp571634m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp571634m » Version: N/A
Schneider-electric » Tsxp57204m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp57204m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp57204m » Version: N/A
Schneider-electric » Tsxp57254m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp57254m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp57254m » Version: N/A
Schneider-electric » Tsxp572634m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp572634m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp572634m » Version: N/A
Schneider-electric » Tsxp57304m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp57304m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp57304m » Version: N/A
Schneider-electric » Tsxp57354m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp57354m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp57354m » Version: N/A
Schneider-electric » Tsxp573634m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp573634m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp573634m » Version: N/A
Schneider-electric » Tsxp57454m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp57454m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp57454m » Version: N/A
Schneider-electric » Tsxp574634m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp574634m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp574634m » Version: N/A
Schneider-electric » Tsxp575634m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp575634m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp575634m » Version: N/A
Schneider-electric » Tsxp576634m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp576634m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp576634m » Version: N/A
Schneider-electric » Tsxp57554m Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:tsxp57554m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp57554m » Version: N/A
Schneider-electric » Modicon M580 Firmware
Versions before (<) 2.80
cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Modicon M580 » Version: N/A
Schneider-electric » Modicon M340 Firmware
Versions before (<) 3.01
cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Modicon M340 » Version: N/A
Schneider-electric » 140cpu67261 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu67261_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu67261 » Version: N/A
Schneider-electric » 140cpu67060 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu67060_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu67060 » Version: N/A
Schneider-electric » 140cpu67160 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu67160_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu67160 » Version: N/A
Schneider-electric » 140cpu67260 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu67260_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu67260 » Version: N/A
Schneider-electric » 140cpu67861 Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu67861_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu67861 » Version: N/A
Schneider-electric » 140cpu67160s Firmware
Versions before (<) 3.52
cpe:2.3:o:schneider-electric:140cpu67160s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu67160s » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-7794

EPSS FAQ

0.39%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 57 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-7794

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2018-7794

CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Assigned by:
- cybersecurity@se.com (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2018-7794

https://www.se.com/ww/en/download/document/SEVD-2019-344-01

Security Notification - Modicon Controllers | Schneider Electric
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-7794

Products affected by CVE-2018-7794

Exploit prediction scoring system (EPSS) score for CVE-2018-7794

CVSS scores for CVE-2018-7794

CWE ids for CVE-2018-7794

References for CVE-2018-7794