Detections
Analytics

Schneider Electric Modicon M340 PLCs Buffer Overflow

critical Nessus Network Monitor Plugin ID 720075

Synopsis

Schneider Electric Modicon M340 PLCs allow arbitrary code execution via a long password.

Description

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.

Solution

Perform vendor recommended mitigations and apply available vendor upgrades.

See Also

http://www.securityfocus.com/bid/79622,https://ics-cert.us-cert.gov/advisories/ICSA-15-351-01,http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-344-01

Plugin Details

Severity: Critical

ID: 720075

Family: SCADA

Published: 5/8/2019

Updated: 9/30/2019

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Patch Publication Date: 12/17/2015

Vulnerability Publication Date: 12/17/2015

Reference Information

CVE: CVE-2015-7937

BID: 79622