CVE-2018-7852

PoC —

CVSS 3.1

7.5 high

EPSS

4%p89

Published

May 22, 2019 (May 22, 2019)

Modified

Jun 17, 2026

Description

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus.

Vendors: schneider-electric
Products: modicon m580 firmware, modicon m340 firmware, modicon quantum firmware, modicon premium firmware
Weakness: CWE-755, CWE-248
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (3.6%)

In the news2 stories

ModiPwn flaw in ModiPwn PLCs bypasses security mechanisms

Security AffairsJul 13, 14:20 UTC · Jul 13, 2021Vulnerability CVE-2021-22779 CVE-2018-7852 CVE-2019-6829+1 CVEs

Vulnerability Spotlight: Multiple vulnerabilities in Schneider Electric Modicon M580

Cisco TalosJun 10, 18:08 UTC · Jun 10, 2019Vulnerability CVE-2018-7846 CVE-2018-7849 CVE-2018-7843+8 CVEs