Description
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus.
Exploits (1)
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
Exploit, Third Party Advisory x_refsource_misc
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0738
Scores
CVSS v3
7.5
EPSS
0.1292
EPSS Percentile
94.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-125
Status
published
Products (4)
schneider-electric/modicon_m340_firmware
schneider-electric/modicon_m580_firmware
schneider-electric/modicon_premium_firmware
schneider-electric/modicon_quantum_firmware
Published
May 22, 2019
Tracked Since
Feb 18, 2026