CVE-2018-7848

HIGH

Modicon - Info Disclosure

Title source: llm
STIX 2.1

Description

A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus

Exploits (1)

nomisec WORKING POC
by yanissec · poc
https://github.com/yanissec/CVE-2018-7848

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0740

Scores

CVSS v3 7.5
EPSS 0.1154
EPSS Percentile 93.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (4)
schneider-electric/modicon_m340_firmware < 3.10
schneider-electric/modicon_m580_firmware < 2.90
schneider-electric/modicon_premium_firmware
schneider-electric/modicon_quantum_firmware
Published May 22, 2019
Tracked Since Feb 18, 2026