CVE-2018-7838 Denial of service in Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16

High 7.5 Published 15 Jul 2019 Updated 5 Aug 2024

A buffer error in Modicon M580 CPUs and Ethernet modules allows remote attackers to cause a denial of service on the FTP service via a long CWD command.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-7838?

CVE-2018-7838 is a high-severity denial of service vulnerability in Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16, published on 15 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.

Weakness: CWE-119

Which versions are affected by CVE-2018-7838?

It affects 13 products.

Products include Schneider-Electric Bmeh582040 Firmware, Schneider-Electric Bmeh586040 Firmware, Schneider-Electric Bmenoc0301 Firmware, Schneider-Electric Modicon M580 Bmep581020 Firmware, Schneider-Electric Modicon M580 Bmep582020 Firmware, Schneider-Electric Modicon M580 Bmep582040 Firmware and 7 more.

How do I fix CVE-2018-7838?

No fix has been published for CVE-2018-7838 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-7838 being exploited?

There is no known exploitation of CVE-2018-7838 in the wild and no public exploit code.

Sources

Also known as GHSA-9v86-72g4-pvjh.