CVE-2018-7812 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses in a way that exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Schneider-Electric	Modicom M340 Firmware	All versions
Schneider-Electric	Modicom M340	-
Schneider-Electric	Modicom Premium Firmware	All versions
Schneider-Electric	Modicom Premium	All versions
Schneider-Electric	Modicom Quantum Firmware	All versions
Schneider-Electric	Modicom Quantum	All versions
Schneider-Electric	Modicom Bmxnor0200H Firmware	All versions
Schneider-Electric	Modicom Bmxnor0200H	-

Related Weaknesses (CWE)

CWE-200

References

https://github.com/SadFud/Exploits/tree/master/Real%20World/SCADA%20-%20IOT%20SyThird Party Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/Vendor Advisory
https://github.com/SadFud/Exploits/tree/master/Real%20World/SCADA%20-%20IOT%20SyThird Party Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/Vendor Advisory

FAQ

What is CVE-2018-7812?

CVE-2018-7812 is a vulnerability with a CVSS score of 7.5 (HIGH). An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses in...

How severe is CVE-2018-7812?

CVE-2018-7812 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-7812?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Modicom M340 Firmware, Schneider-Electric Modicom M340, Schneider-Electric Modicom Premium Firmware, Schneider-Electric Modicom Premium, Schneider-Electric Modicom Quantum Firmware.