Multiple Schneider Electric Modicon M340 Ethernet Modules Remote Denial of Service

medium Nessus Network Monitor Plugin ID 7161

Synopsis

A Schneider Electric Modicon M340 Programmable Logic Controller (PLC) Ethernet module containing a remote denial of service vulnerability has been detected.

Description

Certain Schneider Electric Modicon M340 Programmable Logic Controller (PLC) Ethernet modules contain a vulnerability that allows remote, authenticated users to crash the Ethernet module via specially crafted FTP traffic. This vulnerability has been demonstrated using the FileZilla FTP client. Affected M340 Ethernet modules are the BMXNOE0100, BMXNOE0110, and BMXP342020.

Solution

Per the vendor's advisory, upgrade the M340 Ethernet module firmware to version 2.0 or later.

Plugin Details

Severity: Medium

ID: 7161

Version: 1.0

Family: SCADA

Published: 12/3/2014

Updated: 8/16/2018

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P

Vulnerability Information

CPE: cpe:/h:schneider-electric:modicon_m340

Reference Information

CVE: CVE-2013-2761

BID: 58950

Detections

Analytics