CVE-2018-7847
9.8
CRITICAL · CVSS 3.1 · EPSS 3.8% (pctl 90)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.81% — more likely to be exploited than 90% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-05-22 |
| Last modified | 2026-06-17 |
Affected (8)
| Vendor | Product |
|---|---|
| schneider-electric | modicon m340 |
| schneider-electric | modicon m340 firmware |
| schneider-electric | modicon m580 |
| schneider-electric | modicon m580 firmware |
| schneider-electric | modicon premium |
| schneider-electric | modicon premium firmware |
| schneider-electric | modicon quantum |
| schneider-electric | modicon quantum firmware |
References
- https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0742
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0743
- https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0742
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0743
→ the Explorer · watch your stack · NVD