Detections
Analytics
Schneider Electric Quantum 140NOE771 Network Interface Module Arbitrary Firmware Updates Installation
critical Nessus Network Monitor Plugin ID 720234
Synopsis
Schneider Electric Quantum 140NOE771 Network Interface Module allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code.Description
The modbus_125_handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device (aka the Quantum 140NOE771* module) allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code to TCP port 502.Solution
Perform vendor recommended mitigations and apply available vendor upgrades.See Also
http://reversemode.com/index.php?option=com_content&task=view&id=80&Itemid=1
Plugin Details
Severity: Critical
ID: 720234
Family: SCADA
Published: 5/8/2019
Updated: 9/30/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
Patch Publication Date: 12/17/2011
Vulnerability Publication Date: 12/17/2011
Reference Information
CVE: CVE-2011-4861