Lucene search

SchneiderCVE-2019-6813

HistorySep 17, 2019 - 8:15 p.m.

CVE-2019-6813

2019-09-1720:15:12

CWE-754

schneider

web.nvd.nist.gov

103

cve-2019-6813

cwe-754

bmxnor0200h

ethernet

serial rtu

modicon m340

denial of service

snmp

nvd

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.003

Percentile

70.3%

JSON

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions) and Modicon M340 controller (all firmware versions), which could cause denial of service when truncated SNMP packets on port 161/UDP are received by the device.

Affected configurations

Nvd

Node

schneider-electricmodicon_m340_firmware

AND

schneider-electricmodicon_m340Match-

Node

schneider-electricbmxnor0200h_firmwareMatch-

AND

schneider-electricbmxnor0200hMatch-

VendorProductVersionCPE
schneider-electricmodicon_m340_firmware*cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*
schneider-electricmodicon_m340-cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*
schneider-electricbmxnor0200h_firmware-cpe:2.3:o:schneider-electric:bmxnor0200h_firmware:-:*:*:*:*:*:*:*
schneider-electricbmxnor0200h-cpe:2.3:h:schneider-electric:bmxnor0200h:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
schneider-electric	modicon_m340_firmware	*	cpe:2.3:o:schneider-electric:modicon_m340_firmware::::::::
schneider-electric	modicon_m340	-	cpe:2.3:h:schneider-electric:modicon_m340:-:::::::*
schneider-electric	bmxnor0200h_firmware	-	cpe:2.3:o:schneider-electric:bmxnor0200h_firmware:-:::::::*
schneider-electric	bmxnor0200h	-	cpe:2.3:h:schneider-electric:bmxnor0200h:-:::::::*

CNA Affected

[
  {
    "product": "BMXNOR0200H Ethernet / Serial RTU module",
    "vendor": "CVE-2019-6813",
    "versions": [
      {
        "status": "affected",
        "version": "all firmware versions"
      }
    ]
  },
  {
    "product": "Modicon M340 controller",
    "vendor": "CVE-2019-6813",
    "versions": [
      {
        "status": "affected",
        "version": "all firmware versions"
      }
    ]
  }
]

References

security.cse.iitk.ac.in/responsible-disclosure

www.schneider-electric.com/en/download/document/SEVD-2019-225-02/

www.schneider-electric.com/en/download/document/SEVD-2019-225-03/

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.003

Percentile

70.3%

JSON

Related for CVE-2019-6813