CVE-2018-7850

A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/	Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0743	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicon_m580:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:schneider-electric:modicon_quantum_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicon_quantum:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:schneider-electric:modicon_premium_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicon_premium:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-05-22 20:29

Updated : 2022-02-03 14:10

NVD link : CVE-2018-7850

Mitre link : CVE-2018-7850

CVE.ORG link : CVE-2018-7850

JSON object : View

Products Affected

schneider-electric

modicon_m580_firmware
modicon_quantum
modicon_premium_firmware
modicon_m340_firmware
modicon_premium
modicon_quantum_firmware
modicon_m580
modicon_m340

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-7850", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-05-22T20:29:01.823", "references": [{"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0743", "tags": ["Third Party Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software."}, {"lang": "es", "value": "CWE-807: Existe una vulnerabilidad por confianza en entradas dudosas en una decisi\u00f3n de seguridad en todas las versiones de Modicon M580, Modicon M340, Modicon Quantum y Modicon Premium, que podr\u00eda generar que informaci\u00f3n no v\u00e1lida sea mostrada en el Unity Pro software"}], "lastModified": "2022-02-03T14:10:39.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D52D735D-8AB5-40FE-A83F-266977601571"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicon_m580:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E876C738-ABF6-4864-98A6-1E06E96A0DF4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05CBA9AD-ECB7-453F-8551-DD176FDE8043"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "138681A2-0146-492B-8E10-06849FC27C6E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicon_quantum_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "745CC7A7-70FB-4551-8EBF-600B7A6236D7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicon_quantum:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A9B7CEF7-B9BA-4923-808F-DA2931569EBB"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicon_premium_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "619CFD8D-9652-4AAB-AFC4-796B3F10F61F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicon_premium:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F00936E2-E6EF-4ABF-8666-7D83BE424F42"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@se.com"}