Multiple Schneider Electric Modicon M340 Ethernet Modules Remote Denial of Service

Medium Nessus Network Monitor Plugin ID 7161

Synopsis

A Schneider Electric Modicon M340 Programmable Logic Controller (PLC) Ethernet module containing a remote denial of service vulnerability has been detected.

Description

Certain Schneider Electric Modicon M340 Programmable Logic Controller (PLC) Ethernet modules contain a vulnerability that allows remote, authenticated users to crash the Ethernet module via specially crafted FTP traffic. This vulnerability has been demonstrated using the FileZilla FTP client. Affected M340 Ethernet modules are the BMXNOE0100, BMXNOE0110, and BMXP342020.

Solution

Per the vendor's advisory, upgrade the M340 Ethernet module firmware to version 2.0 or later.

Plugin Details

Severity: Medium

ID: 7161

Version: 1.0

Family: SCADA

Published: 2014/12/03

Modified: 2018/09/16

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4

Temporal Score: 3.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/h:schneider-electric:modicon_m340

Reference Information

CVE: CVE-2013-2761

BID: 58950