Multiple Schneider Electric Modicon M340 Ethernet Modules Remote Denial of Service

medium Nessus Network Monitor Plugin ID 38

Synopsis

A Schneider Electric Modicon M340 Programmable Logic Controller (PLC) Ethernet module containing a remote denial of service vulnerability has been detected.

Description

Certain Schneider Electric Modicon M340 Programmable Logic Controller (PLC) Ethernet modules contain a vulnerability that allows remote, authenticated users to crash the Ethernet module via specially crafted FTP traffic. This vulnerability has been demonstrated using the FileZilla FTP client. Affected M340 Ethernet modules are the BMXNOE0100, BMXNOE0110, and BMXP342020.

Solution

Per the vendor's advisory, upgrade the M340 Ethernet module firmware to version 2.0 or later.

Plugin Details

Severity: Medium

ID: 38

Family: SCADA

Published: 5/21/2019

Updated: 9/30/2019

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P

Vulnerability Information

CPE: cpe:/h:schneider-electric:modicon_m340

Patch Publication Date: 4/4/2013

Vulnerability Publication Date: 4/4/2013

Reference Information

CVE: CVE-2013-2761

BID: 58950

Detections

Analytics