CVSS: 9.8EPSS: 0%CPEs: 108EXPL: 0CVE-2022-45788
https://notcve.org/view.php?id=CVE-2022-45788
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions), Modicon Momentum Unity M1E Processor - 171CBU* (All Versions), Modicon MC80 - BMKC80 (All Versions), Legacy Modicon Quantum - 140CPU65* and Premium CPUs - TSXP57* (All Versions) • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 96EXPL: 0CVE-2022-37301
https://notcve.org/view.php?id=CVE-2022-37301
A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34*)(V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*)(V3.22 and prior), Legacy Modicon Quantum/Premium(All Versions), Modicon Momentum MDI (171CBU*)(All Versions), Modicon MC80 (BMKC80)(V1.7 and prior) Existe una vulnerabilidad CWE-191: Integer Underflow (Wrap o Wraparound) que podría causar una Denegación de Servicio (DoS) del controlador debido a violaciones de acceso a la memoria cuando se utiliza el protocolo Modbus TCP. Productos afectados: CPU Modicon M340 (números de pieza BMXP34*)(V3.40 y anteriores), CPU Modicon M580 (números de pieza BMEP* y BMEH*)(V3.22 y anteriores), Modicon Quantum/Premium heredado (todas las versiones), Modicon Momentum MDI (171CBU*)(todas las versiones), Modicon MC80 (BMKC80)(V1.7 y anteriores) • https://www.se.com/us/en/download/document/SEVD-2022-221-02 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2019-6828
https://notcve.org/view.php?id=CVE-2019-6828
A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Premium (all versions), and Modicon Quantum (all versions), which could cause a possible denial of service when reading specific coils and registers in the controller over Modbus. Una CWE-248: Se presenta una vulnerabilidad de Excepción No Capturada en Modicon M580 (versión de firmware anterior a V2.90), Modicon M340 (versión de firmware anterior a V3.10), Modicon Premium (todas las versiones) y Modicon Quantum (todas las versiones), lo que podría causar una posible denegación de servicio durante la lectura de bobinas y registros específicos en el controlador sobre protocolo Modbus. • https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11 • CWE-248: Uncaught Exception CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2019-6809
https://notcve.org/view.php?id=CVE-2019-6809
A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior to V3.10), Modicon Premium (all versions), Modicon Quantum (all versions), which could cause a possible denial of service when reading invalid data from the controller. Una CWE-248: Se presenta una vulnerabilidad de Excepción No Capturada en Modicon M580 (versiones de firmware anteriores a V2.90), Modicon M340 (versiones de firmware anteriores a V3.10), Modicon Premium (todas las versiones), Modicon Quantum (todas las versiones), que podría causar una posible denegación de servicio durante la lectura de datos no válidos desde el controlador. • https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11 • CWE-248: Uncaught Exception CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 2CVE-2018-7844
https://notcve.org/view.php?id=CVE-2018-7844
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus. Una CWE-200: Existe una vulnerabilidad de Exposición de Información en todas las versiones de Modicon M580, Modicon M340, Modicon Quantum y Modicon Premium, lo que podría generar la divulgación de información SNMP cuando se leen bloques de memoria desde el controlador sobre protocolo Modbus. • https://github.com/yanissec/CVE-2018-7844 https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11 https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0739 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •