Details of VAR-201905-1030

ID

VAR-201905-1030

CVE

CVE-2018-7848

TITLE

plural Modicon Information disclosure vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-015475

DESCRIPTION

A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus. plural Modicon The product contains an information disclosure vulnerability.Information may be obtained. Schneider Electric Modicon M580 and other products are products of Schneider Electric (France). Schneider Electric Modicon M580 is a programmable automation controller. Schneider Electric Modicon Premium is a large programmable logic controller (PLC) for discrete or process applications. Schneider Electric Modicon Quantum is a large programmable logic controller (PLC) for process applications, high availability and safety solutions. An attacker could use the vulnerability to obtain sensitive information about the affected components. This vulnerability stems from configuration errors in network systems or products during operation. The following products and versions are affected: Schneider Electric Modicon M580 (all versions); Modicon M340 (all versions); Modicon Quantum (all versions); Modicon Premium (all versions)

Trust: 2.52

sources: NVD: CVE-2018-7848 // JVNDB: JVNDB-2018-015475 // CNVD: CNVD-2019-34828 // IVD: ac1f1b0e-3ce8-4fc5-a3fd-16af90549c64 // VULHUB: VHN-137880 // VULMON: CVE-2018-7848

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: ac1f1b0e-3ce8-4fc5-a3fd-16af90549c64 // CNVD: CNVD-2019-34828

AFFECTED PRODUCTS

vendor:	schneider electric	model:	modicon m580	scope:	lt	version:	2.90	Trust: 1.0
vendor:	schneider electric	model:	modicon m340	scope:	lt	version:	3.10	Trust: 1.0
vendor:	schneider electric	model:	modicon quantum	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon premium	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	modicon m580	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	modicon premium plc	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	modicon quantum plc	scope:	-	version:	-	Trust: 0.8
vendor:	schneider	model:	electric modicon m340	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric modicon m580	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric modicon premium	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric modicon quantum	scope:	-	version:	-	Trust: 0.6
vendor:	modicon m580	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	modicon m340	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	modicon quantum	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	modicon premium	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: ac1f1b0e-3ce8-4fc5-a3fd-16af90549c64 // CNVD: CNVD-2019-34828 // JVNDB: JVNDB-2018-015475 // NVD: CVE-2018-7848

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-7848
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-7848
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2019-34828
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201905-921
value:	HIGH
Trust: 0.6
IVD:	ac1f1b0e-3ce8-4fc5-a3fd-16af90549c64
value:	HIGH
Trust: 0.2
VULHUB:	VHN-137880
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2018-7848
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-7848
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2019-34828
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	ac1f1b0e-3ce8-4fc5-a3fd-16af90549c64
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-137880
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-7848
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2018-7848
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: IVD: ac1f1b0e-3ce8-4fc5-a3fd-16af90549c64 // CNVD: CNVD-2019-34828 // VULHUB: VHN-137880 // VULMON: CVE-2018-7848 // JVNDB: JVNDB-2018-015475 // CNNVD: CNNVD-201905-921 // NVD: CVE-2018-7848

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-137880 // JVNDB: JVNDB-2018-015475 // NVD: CVE-2018-7848

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-921

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201905-921

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-015475

PATCH

title:	SEVD-2019-134-11	url:	https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/	Trust: 0.8
title:	-	url:	https://github.com/yanissec/CVE-2018-7848	Trust: 0.1

sources: VULMON: CVE-2018-7848 // JVNDB: JVNDB-2018-015475

EXTERNAL IDS

db:	NVD	id:	CVE-2018-7848	Trust: 3.4
db:	SCHNEIDER	id:	SEVD-2019-134-11	Trust: 1.8
db:	TALOS	id:	TALOS-2018-0740	Trust: 1.8
db:	CNNVD	id:	CNNVD-201905-921	Trust: 0.9
db:	CNVD	id:	CNVD-2019-34828	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-015475	Trust: 0.8
db:	IVD	id:	AC1F1B0E-3CE8-4FC5-A3FD-16AF90549C64	Trust: 0.2
db:	VULHUB	id:	VHN-137880	Trust: 0.1
db:	VULMON	id:	CVE-2018-7848	Trust: 0.1

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2018-7848	Trust: 2.0
url:	https://www.schneider-electric.com/en/download/document/sevd-2019-134-11/	Trust: 1.8
url:	https://www.talosintelligence.com/vulnerability_reports/talos-2018-0740	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7848	Trust: 0.8
url:	https://talosintelligence.com/vulnerability_reports/talos-2018-0740	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/200.html	Trust: 0.1
url:	https://github.com/yanissec/cve-2018-7848	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2019-34828 // VULHUB: VHN-137880 // VULMON: CVE-2018-7848 // JVNDB: JVNDB-2018-015475 // CNNVD: CNNVD-201905-921 // NVD: CVE-2018-7848

CREDITS

Discovered by Jared Rittle of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-201905-921

SOURCES

db:	IVD	id:	ac1f1b0e-3ce8-4fc5-a3fd-16af90549c64
db:	CNVD	id:	CNVD-2019-34828
db:	VULHUB	id:	VHN-137880
db:	VULMON	id:	CVE-2018-7848
db:	JVNDB	id:	JVNDB-2018-015475
db:	CNNVD	id:	CNNVD-201905-921
db:	NVD	id:	CVE-2018-7848

LAST UPDATE DATE

2024-11-23T21:52:12.740000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-34828	date:	2019-10-12T00:00:00
db:	VULHUB	id:	VHN-137880	date:	2019-06-10T00:00:00
db:	VULMON	id:	CVE-2018-7848	date:	2022-02-03T00:00:00
db:	JVNDB	id:	JVNDB-2018-015475	date:	2019-06-07T00:00:00
db:	CNNVD	id:	CNNVD-201905-921	date:	2022-03-10T00:00:00
db:	NVD	id:	CVE-2018-7848	date:	2024-11-21T04:12:52.373

SOURCES RELEASE DATE

db:	IVD	id:	ac1f1b0e-3ce8-4fc5-a3fd-16af90549c64	date:	2019-10-12T00:00:00
db:	CNVD	id:	CNVD-2019-34828	date:	2019-10-11T00:00:00
db:	VULHUB	id:	VHN-137880	date:	2019-05-22T00:00:00
db:	VULMON	id:	CVE-2018-7848	date:	2019-05-22T00:00:00
db:	JVNDB	id:	JVNDB-2018-015475	date:	2019-06-07T00:00:00
db:	CNNVD	id:	CNNVD-201905-921	date:	2019-05-22T00:00:00
db:	NVD	id:	CVE-2018-7848	date:	2019-05-22T20:29:01.747