Modicon Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16
At a glance
- Source
- NVD
- EPSS
- EPSS 1.12 % · percentile 66 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- schneider
- NVD status
- Modified
Description
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.
Weaknesses (CWE)
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-19550
- GCVE · GCVE-0-2018-7838
CERT-FR advisories
- CERTFR-2019-AVI-312 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:schneider-electric:bmenoc0301_firmware:*:*:*:*:*:*:*:*< 2.16cpe:2.3:o:schneider-electric:modicon_m580_bmep584040_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep586040_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:bmeh586040_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep581020_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep582020_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep582040_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep583020_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep583040_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep584020_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep585040_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:modicon_m580_bmep582040s_firmware:*:*:*:*:*:*:*:*< 2.90cpe:2.3:o:schneider-electric:bmeh582040_firmware:*:*:*:*:*:*:*:*< 2.90
Affected products
| Product | Versions |
|---|---|
| Modicon · Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16 | affected Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |