CVE-2019-6829:A CWE-248: Uncaught Exception vulnerability in Modicon M580 and Modicon M340 could lead to a denial of service when writing to specific memory addresses over Modbus.

splash
Back

Description Preview

CVE-2019-6829 describes a vulnerability categorized as CWE-248: Uncaught Exception, which affects Schneider Electric's Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prior to V3.10). This vulnerability can be exploited by sending specific commands over the Modbus protocol that write to certain memory addresses in the controller. If exploited, this could result in a denial of service condition, impacting the availability of the affected devices.

Overview

  • Affected Products:

    • Modicon M580 (firmware version prior to V2.90)
    • Modicon M340 (firmware version prior to V3.10)

  • Vulnerability Type:

    • CWE-248: Uncaught Exception

  • Impact:

    • Possible denial of service when specific memory addresses are targeted over Modbus.

Remediation

To mitigate the risk associated with CVE-2019-6829, users are advised to update their firmware to the following versions:

  • Upgrade Modicon M580 to firmware version V2.90 or later.
  • Upgrade Modicon M340 to firmware version V3.10 or later.

It is recommended to regularly check for firmware updates and apply them promptly to ensure the security and reliability of the devices.

References

These references provide additional context and guidance regarding the vulnerability and its remediation.

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Low
    Manufacturing
  2. Utilities: Low
    Utilities
  3. Public Administration: Low
    Public Administration
  4. Transportation & Warehousing: Low
    Transportation & Warehousing
  5. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  6. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  7. Accommodation & Food Services: Low
    Accommodation & Food Services
  8. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  9. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  10. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  11. Construction: Low
    Construction
  12. Educational Services: Low
    Educational Services
  13. Finance and Insurance: Low
    Finance and Insurance
  14. Health Care & Social Assistance: Low
    Health Care & Social Assistance
  15. Information: Low
    Information
  16. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  17. Mining: Low
    Mining
  18. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  19. Retail Trade: Low
    Retail Trade
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background