CVE-2018-7846
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller.
CWE-501: Existe una vulnerabilidad de violación de límite de confianza en la conexión al controlador, en todas las versiones de Modicon M580, Modicon M340, Modicon Quantum y Modicon Premium, lo que podría generar un acceso no autorizado al realizar un ataque de fuerza bruta sobre el protocolo Modbus hacia el controlador.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2018-03-08 CVE Reserved
- 2019-05-22 CVE Published
- 2023-04-28 EPSS Updated
- 2023-10-25 First Exploit
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-668: Exposure of Resource to Wrong Sphere
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/yanissec/CVE-2018-7846 | 2023-10-25 | |
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0735 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11 | 2022-02-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Schneider-electric Search vendor "Schneider-electric" | Modicon M580 Firmware Search vendor "Schneider-electric" for product "Modicon M580 Firmware" | * | - |
Affected
| in | Schneider-electric Search vendor "Schneider-electric" | Modicon M580 Search vendor "Schneider-electric" for product "Modicon M580" | - | - |
Safe
|
| Schneider-electric Search vendor "Schneider-electric" | Modicon M340 Firmware Search vendor "Schneider-electric" for product "Modicon M340 Firmware" | * | - |
Affected
| in | Schneider-electric Search vendor "Schneider-electric" | Modicon M340 Search vendor "Schneider-electric" for product "Modicon M340" | - | - |
Safe
|
| Schneider-electric Search vendor "Schneider-electric" | Modicon Quantum Firmware Search vendor "Schneider-electric" for product "Modicon Quantum Firmware" | * | - |
Affected
| in | Schneider-electric Search vendor "Schneider-electric" | Modicon Quantum Search vendor "Schneider-electric" for product "Modicon Quantum" | - | - |
Safe
|
| Schneider-electric Search vendor "Schneider-electric" | Modicon Premium Firmware Search vendor "Schneider-electric" for product "Modicon Premium Firmware" | * | - |
Affected
| in | Schneider-electric Search vendor "Schneider-electric" | Modicon Premium Search vendor "Schneider-electric" for product "Modicon Premium" | - | - |
Safe
|