Sign-up

ID

VAR-201811-0561


CVE

CVE-2018-7798


TITLE

Modicon M221 Vulnerabilities related to insufficient validation of data reliability

Trust: 0.8

sources: JVNDB: JVNDB-2018-011939

DESCRIPTION

A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration (IP address, mask and gateway) when remotely connected to the device. Modicon M221 Contains vulnerabilities related to insufficient validation of data reliability.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. Schneider Electric Modicon M221 is prone to a remote security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks

Trust: 1.89

sources: NVD: CVE-2018-7798 // JVNDB: JVNDB-2018-011939 // BID: 105970

AFFECTED PRODUCTS

vendor:schneider electricmodel:somachine basicscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:somachine basicscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:somachine basicscope:eqversion:1.0

Trust: 0.6

vendor:schneider electricmodel:somachine basicscope:eqversion:1.1

Trust: 0.6

vendor:schneider electricmodel:somachine basicscope:eqversion:1.5

Trust: 0.6

vendor:schneider electricmodel:somachine basicscope:eqversion:1.2

Trust: 0.6

vendor:schneider electricmodel:somachine basicscope:eqversion:1.4

Trust: 0.6

vendor:schneider electricmodel:somachine basicscope:eqversion:1.3

Trust: 0.6

vendor:schneider electricmodel:somachine basicscope:eqversion:1.6

Trust: 0.6

vendor:schneider electricmodel:modicon m221scope:eqversion:1.6.2.0

Trust: 0.3

vendor:schneider electricmodel:modicon m221scope:eqversion:1.5.0.1

Trust: 0.3

vendor:schneider electricmodel:modicon m221scope:eqversion:1.5.0.0

Trust: 0.3

sources: BID: 105970 // JVNDB: JVNDB-2018-011939 // CNNVD: CNNVD-201811-040 // NVD: CVE-2018-7798

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2018-7798
value: HIGH

Trust: 1.8

CNNVD: CNNVD-201811-040
value: HIGH

Trust: 0.6

NVD: CVE-2018-7798
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2018-7798
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 4.2
version: 3.1

Trust: 1.0

NVD: CVE-2018-7798
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2018-011939 // CNNVD: CNNVD-201811-040 // NVD: CVE-2018-7798

PROBLEMTYPE DATA

problemtype:CWE-345

Trust: 1.8

sources: JVNDB: JVNDB-2018-011939 // NVD: CVE-2018-7798

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201811-040

TYPE

data forgery

Trust: 0.6

sources: CNNVD: CNNVD-201811-040

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2018-7798

PATCH
title:SEVD-2018-270-01url:https://www.schneider-electric.com/en/download/document/sevd-2018-270-01/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-011939

EXTERNAL IDS
db:NVDid:CVE-2018-7798
Trust: 2.7
db:BIDid:105970
Trust: 1.9
db:SCHNEIDERid:SEVD-2018-270-01
Trust: 1.6
db:ICS CERTid:ICSA-18-324-02
Trust: 1.1
db:JVNDBid:JVNDB-2018-011939
Trust: 0.8
db:CNNVDid:CNNVD-201811-040
Trust: 0.6
sources:
            
            
            BID: 105970 // 
            
            
            
            JVNDB: JVNDB-2018-011939 // 
            
            
            
            CNNVD: CNNVD-201811-040 // 
            
            
            
            NVD: CVE-2018-7798

REFERENCES
url:https://www.schneider-electric.com/en/download/document/sevd-2018-270-01/
Trust: 1.6
url:https://www.securityfocus.com/bid/105970
Trust: 1.6
url:https://ics-cert.us-cert.gov/advisories/icsa-18-324-02
Trust: 1.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7798
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-7798
Trust: 0.8
url:http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true
Trust: 0.3
sources:
            
            
            BID: 105970 // 
            
            
            
            JVNDB: JVNDB-2018-011939 // 
            
            
            
            CNNVD: CNNVD-201811-040 // 
            
            
            
            NVD: CVE-2018-7798

CREDITS
Eran Goldstein of CRITIFENCE
Trust: 0.3
sources:
            
            
            BID: 105970

SOURCES
db:BIDid:105970
db:JVNDBid:JVNDB-2018-011939
db:CNNVDid:CNNVD-201811-040
db:NVDid:CVE-2018-7798

LAST UPDATE DATE
2022-05-04T09:16:42.065000+00:00

SOURCES UPDATE DATE
db:BIDid:105970date:2018-11-20T00:00:00
db:JVNDBid:JVNDB-2018-011939date:2019-01-25T00:00:00
db:CNNVDid:CNNVD-201811-040date:2021-08-24T00:00:00
db:NVDid:CVE-2018-7798date:2022-01-31T20:31:00

SOURCES RELEASE DATE
db:BIDid:105970date:2018-11-20T00:00:00
db:JVNDBid:JVNDB-2018-011939date:2019-01-25T00:00:00
db:CNNVDid:CNNVD-201811-040date:2018-11-05T00:00:00
db:NVDid:CVE-2018-7798date:2018-11-02T17:29:00