8.8high
CVE-2018-7240
A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary cod…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.2%
percentile 88%
Public exploits
0
none known
Summary
A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution. An FTP command used to upgrade the firmware of the module can be misused to cause a denial of service, or in extreme cases, to load a malicious firmware.
Exploit prediction (EPSS)
3.20% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- Schneider Electric SE Modicon Quantum
Classification
- Weakness
- CWE-787 Out-of-bounds Write
References
- schneider-electric.com /en/download/document/SEVD-2018-081-01/ · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/103541 · vdb-entry, x_refsource_BID, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-18-086-01 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-7240
- NVD: CVE-2018-7240
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.