CVE-2020-7524 Memory corruption in Modicon M218 Logic Controller V5.0.0.7 and prior
An attacker can cause a denial of service on Schneider Electric Modicon M218 Logic Controllers by sending a crafted IPv4 packet, requiring a power cycle to recover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7524?
CVE-2020-7524 is a high-severity memory corruption vulnerability in Modicon M218 Logic Controller V5.0.0.7 and prior, published on 31 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial of Service when sending specific crafted IPV4 packet to the controller: Sending a specific IPv4 protocol package to Schneider Electric Modicon M218 Logic Controller can cause IPv4 devices to go down. The device does not work properly and must be powered back on to return to normal.
Weakness: CWE-787
Which versions are affected by CVE-2020-7524?
It affects 1 product.
Products include Schneider-Electric Modicon M218 Firmware.
How do I fix CVE-2020-7524?
No fix has been published for CVE-2020-7524 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-7524 being exploited?
There is no known exploitation of CVE-2020-7524 in the wild and no public exploit code.
Other vulnerabilities in Modicon M218 Logic Controller V5.0.0.7 and prior
Sources
Also known as GHSA-v479-fx8q-4c3m.