CVE-2018-7811

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server

CVSS v3 9.8 CRITICAL
CVSS v2.0 5.0 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://security.cse.iitk.ac.in/responsible-disclosure
https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/	Vendor Advisory
https://www.tenable.com/security/research/tra-2018-38	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:schneider-electric:modicom_m340_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicom_m340:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:schneider-electric:modicom_premium_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicom_premium:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:schneider-electric:modicom_quantum_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicom_quantum:*:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:schneider-electric:modicom_bmxnor0200h_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicom_bmxnor0200h:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-11-30 19:29

Updated : 2019-10-02 13:15

NVD link : CVE-2018-7811

Mitre link : CVE-2018-7811

CVE.ORG link : CVE-2018-7811

JSON object : View

Products Affected

schneider-electric

modicom_bmxnor0200h_firmware
modicom_quantum
modicom_quantum_firmware
modicom_premium_firmware
modicom_premium
modicom_bmxnor0200h
modicom_m340
modicom_m340_firmware

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2018-7811", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-11-30T19:29:00.500", "references": [{"url": "https://security.cse.iitk.ac.in/responsible-disclosure", "source": "cybersecurity@se.com"}, {"url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "https://www.tenable.com/security/research/tra-2018-38", "tags": ["Exploit", "Third Party Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server"}, {"lang": "es", "value": "Existe un cambio de contrase\u00f1a sin verificar en los servidores web embebidos en todos los productos Modicon M340, Premium, Quantum PLCs y BMXNOR0200, lo que podr\u00eda permitir que un usuario remoto no autenticado acceda a la funci\u00f3n de cambio de contrase\u00f1as del servidor web."}], "lastModified": "2019-10-02T13:15:10.997", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicom_m340_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A53C0B78-6556-44B7-9546-75F48EDD87CB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicom_m340:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F3D3249-CD51-496E-AB39-79D53EB318F8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicom_premium_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA79EF8E-C525-4CCB-AC21-F7493FA55BF7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicom_premium:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8BAD47C7-A8D1-44B3-9917-D5285E63F3B5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicom_quantum_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62BAE494-82C9-4CC7-8149-37DD1ADA10F2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicom_quantum:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1B17B062-016A-45C2-A640-C8FD31E6E05F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicom_bmxnor0200h_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D99FE33D-BBA0-40B7-B79C-E276BF8353FB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicom_bmxnor0200h:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8C420C7F-5B35-4775-8775-241FDD0B759C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@se.com"}