CVE-2018-7842
critical · 9.8A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller.
9.8
CVSS
35.0%
EPSS (exploit prob.)
98th
EPSS percentile
2019-05-22
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-290
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| schneider-electric | modicon_m580_firmware | all versions |
| schneider-electric | modicon_m580 | all versions |
| schneider-electric | modicon_m340_firmware | all versions |
| schneider-electric | modicon_m340 | all versions |
| schneider-electric | modicon_quantum_firmware | all versions |
| schneider-electric | modicon_quantum | all versions |
| schneider-electric | modicon_premium_firmware | all versions |
| schneider-electric | modicon_premium | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-7842