Skip to content
OpenAdvisories
Medium SEVD-2019-281-02 6 CVEs

Modicon Controllers

Published Sep 26, 2019 · Updated Aug 13, 2024 · Revision 9

Vendor: Schneider Electric Product: Modicon BMxCRA and 140CRA modules Product: Modicon M340 Product: Modicon M340 All versions Product: Modicon M580 Product: Modicon M580 CPU Safety

Summary

Schneider Electric is aware of multiple vulnerabilities in the Modicon Controller products.
March 2023 Update: Remediation for the Modicon M580 CPU is available for download

Vulnerabilities 6

  • Unscored —
    CVE-2019-6841 EPSS 24%

    A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prio…

  • Unscored —
    CVE-2019-6842

    A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxC…

  • Unscored —
    CVE-2019-6843

    A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prio…

  • Unscored —
    CVE-2019-6844

    A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxC…

  • Unscored —
    CVE-2019-6846

    A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon …

  • Unscored —
    CVE-2019-6847

    A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxC…

Revision history

  1. #7.0.0

    Remediation for the Modicon M580 CPU Safety is available for download (page 4).

  2. #6.0.0

    Remediation for the Modicon M580 CPU is available for download

  3. #5.0.0

    The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities.

  4. #4.0.0

    A clarification was added to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges. The purpose of the notification update is to inform customers that the latest fix Modicon M580 V4.02 does not apply to the Safety range of M580. It is highly recommended that customers using Modicon M580 Safety ranges continue to implement the mitigations shared in this document

  5. #3.1.0

    The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

  6. #3.0.0

    A fix is available in Modicon M580 V4.02 that addresses vulnerabilities related to FTP. The FTP protocol was previously required during firmware upgrade process, and it has been replaced by HTTPS protocol.

  7. #2.1.0

    Updated CWE for: • CVE-2019-6841 • CVE-2019-6842 • CVE-2019-6843 • CVE-2019-6844 • CVE-2019-6847

  8. #2.0.0

    Fix now available for M580 firmware version 3.10 for CVE-2019-6841, CVE-2019-6843, CVE-2019-6844

  9. #1.0.0

    Original Release

References