CVE-2018-7838

HIGH

Schneider Electric Modicon M580 and BMENOC0301 - Denial of Service via FTP CWD Command

Title source: llm
STIX 2.1

Description

A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0037
EPSS Percentile 58.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-119
Status published
Products (13)
schneider-electric/bmeh582040_firmware < 2.90
schneider-electric/bmeh586040_firmware < 2.90
schneider-electric/bmenoc0301_firmware < 2.16
schneider-electric/modicon_m580_bmep581020_firmware < 2.90
schneider-electric/modicon_m580_bmep582020_firmware < 2.90
schneider-electric/modicon_m580_bmep582040_firmware < 2.90
schneider-electric/modicon_m580_bmep582040s_firmware < 2.90
schneider-electric/modicon_m580_bmep583020_firmware < 2.90
schneider-electric/modicon_m580_bmep583040_firmware < 2.90
schneider-electric/modicon_m580_bmep584020_firmware < 2.90
... and 3 more
Published Jul 15, 2019
Tracked Since Feb 18, 2026