CVE-2018-7240 Command injection in Modicon Quantum

High 8.8 Published 18 Apr 2018 Updated 5 Aug 2024

Attackers can exploit an FTP command in Schneider Electric Modicon Quantum modules to execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-7240?

CVE-2018-7240 is a high-severity command injection vulnerability in Schneider Electric SE Modicon Quantum, published on 18 Apr 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution. An FTP command used to upgrade the firmware of the module can be misused to cause a denial of service, or in extreme cases, to load a malicious firmware.

Weakness: CWE-787

Which versions are affected by CVE-2018-7240?

It affects 13 products.

Products include Schneider-Electric 140cpu31110 Firmware, Schneider-Electric 140cpu31110c Firmware, Schneider-Electric 140cpu43412u Firmware, Schneider-Electric 140cpu43412uc Firmware, Schneider-Electric 140cpu65150 Firmware, Schneider-Electric 140cpu65150c Firmware and 7 more.

How do I fix CVE-2018-7240?

No fix has been published for CVE-2018-7240 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2018-7240 being exploited?

There is no known exploitation of CVE-2018-7240 in the wild and no public exploit code.

Sources

Also known as GHSA-62m4-6p37-pc95.