Details of VAR-201909-0046

ID

VAR-201909-0046

CVE

CVE-2019-6830

TITLE

Schneider Electric Modicon M580 Denial of service vulnerability

Trust: 0.8

sources: IVD: d465b226-b230-48f4-a247-c1b453d4f2f5 // CNVD: CNVD-2019-38871

DESCRIPTION

A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of service when sending an appropriately timed HTTP request to the controller. Modicon M580 Contains a vulnerability in handling exceptional conditions.Service operation interruption (DoS) There is a possibility of being put into a state. Schneider Electric Modicon M580 is a programmable automation controller from Schneider Electric of France. A security vulnerability exists in Schneider Electric Modicon M580 using firmware versions prior to V2.80. An attacker could exploit this vulnerability to cause a denial of service

Trust: 2.43

sources: NVD: CVE-2019-6830 // JVNDB: JVNDB-2019-009522 // CNVD: CNVD-2019-38871 // IVD: d465b226-b230-48f4-a247-c1b453d4f2f5 // VULMON: CVE-2019-6830

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: d465b226-b230-48f4-a247-c1b453d4f2f5 // CNVD: CNVD-2019-38871

AFFECTED PRODUCTS

vendor:	schneider electric	model:	modicon m580	scope:	lt	version:	2.80	Trust: 1.8
vendor:	schneider	model:	electric modicon m580	scope:	lt	version:	v2.80	Trust: 0.6
vendor:	modicon m580	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: d465b226-b230-48f4-a247-c1b453d4f2f5 // CNVD: CNVD-2019-38871 // JVNDB: JVNDB-2019-009522 // NVD: CVE-2019-6830

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-6830
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-6830
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2019-38871
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201908-922
value:	MEDIUM
Trust: 0.6
IVD:	d465b226-b230-48f4-a247-c1b453d4f2f5
value:	MEDIUM
Trust: 0.2
VULMON:	CVE-2019-6830
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-6830
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2019-38871
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	d465b226-b230-48f4-a247-c1b453d4f2f5
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2019-6830
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.2
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2019-6830
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: IVD: d465b226-b230-48f4-a247-c1b453d4f2f5 // CNVD: CNVD-2019-38871 // VULMON: CVE-2019-6830 // JVNDB: JVNDB-2019-009522 // CNNVD: CNNVD-201908-922 // NVD: CVE-2019-6830

PROBLEMTYPE DATA

problemtype:	CWE-755	Trust: 1.8
problemtype:	CWE-248	Trust: 1.0

sources: JVNDB: JVNDB-2019-009522 // NVD: CVE-2019-6830

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201908-922

TYPE

other

Trust: 0.8

sources: IVD: d465b226-b230-48f4-a247-c1b453d4f2f5 // CNNVD: CNNVD-201908-922

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-009522

PATCH

title:	SEVD-2019-134-11	url:	https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/	Trust: 0.8
title:	Patch for Schneider Electric Modicon M580 Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/188177	Trust: 0.6
title:	Schneider Electric Modicon M580 Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=96607	Trust: 0.6
title:	-	url:	https://github.com/Live-Hack-CVE/CVE-2019-6830	Trust: 0.1

sources: CNVD: CNVD-2019-38871 // VULMON: CVE-2019-6830 // JVNDB: JVNDB-2019-009522 // CNNVD: CNNVD-201908-922

EXTERNAL IDS

db:	NVD	id:	CVE-2019-6830	Trust: 3.3
db:	SCHNEIDER	id:	SEVD-2019-134-11	Trust: 2.3
db:	CNVD	id:	CNVD-2019-38871	Trust: 0.8
db:	CNNVD	id:	CNNVD-201908-922	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-009522	Trust: 0.8
db:	TALOS	id:	TALOS-2019-0808	Trust: 0.6
db:	IVD	id:	D465B226-B230-48F4-A247-C1B453D4F2F5	Trust: 0.2
db:	VULMON	id:	CVE-2019-6830	Trust: 0.1

REFERENCES

url:	https://www.schneider-electric.com/en/download/document/sevd-2019-134-11/	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2019-6830	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6830	Trust: 0.8
url:	https://www.talosintelligence.com/vulnerability_reports/talos-2019-0808	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/755.html	Trust: 0.1
url:	https://github.com/live-hack-cve/cve-2019-6830	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2019-38871 // VULMON: CVE-2019-6830 // JVNDB: JVNDB-2019-009522 // CNNVD: CNNVD-201908-922 // NVD: CVE-2019-6830

CREDITS

Discovered by Jared Rittle of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-201908-922

SOURCES

db:	IVD	id:	d465b226-b230-48f4-a247-c1b453d4f2f5
db:	CNVD	id:	CNVD-2019-38871
db:	VULMON	id:	CVE-2019-6830
db:	JVNDB	id:	JVNDB-2019-009522
db:	CNNVD	id:	CNNVD-201908-922
db:	NVD	id:	CVE-2019-6830

LAST UPDATE DATE

2024-11-23T21:52:12.705000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-38871	date:	2019-11-04T00:00:00
db:	VULMON	id:	CVE-2019-6830	date:	2022-10-14T00:00:00
db:	JVNDB	id:	JVNDB-2019-009522	date:	2019-09-24T00:00:00
db:	CNNVD	id:	CNNVD-201908-922	date:	2019-09-30T00:00:00
db:	NVD	id:	CVE-2019-6830	date:	2024-11-21T04:47:14.273

SOURCES RELEASE DATE

db:	IVD	id:	d465b226-b230-48f4-a247-c1b453d4f2f5	date:	2019-11-04T00:00:00
db:	CNVD	id:	CNVD-2019-38871	date:	2019-11-01T00:00:00
db:	VULMON	id:	CVE-2019-6830	date:	2019-09-17T00:00:00
db:	JVNDB	id:	JVNDB-2019-009522	date:	2019-09-24T00:00:00
db:	CNNVD	id:	CNNVD-201908-922	date:	2019-08-13T00:00:00
db:	NVD	id:	CVE-2019-6830	date:	2019-09-17T20:15:12.267