CVE-2019-6842 — MEDIUM (4.9)

Vulnerability Description

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the firmware with a missing web server image inside the package using FTP protocol.

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Schneider-Electric	Modicon M580 Firmware	All versions
Schneider-Electric	Modicon M580	-
Schneider-Electric	Modicon M340 Firmware	All versions
Schneider-Electric	Modicon M340	-
Schneider-Electric	Modicon Bmxcra Firmware	All versions
Schneider-Electric	Modicon Bmxcra	-
Schneider-Electric	Modicon 140Cra Firmware	All versions
Schneider-Electric	Modicon 140Cra	-

Related Weaknesses (CWE)

CWE-755

References

https://www.se.com/ww/en/download/document/SEVD-2019-281-02/Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2019-281-02/Vendor Advisory

FAQ

What is CVE-2019-6842?

CVE-2019-6842 is a vulnerability with a CVSS score of 4.9 (MEDIUM). A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Serv...

How severe is CVE-2019-6842?

CVE-2019-6842 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-6842?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Modicon M580 Firmware, Schneider-Electric Modicon M580, Schneider-Electric Modicon M340 Firmware, Schneider-Electric Modicon M340, Schneider-Electric Modicon Bmxcra Firmware.