CVE-2018-7852

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755 CWE-248

Affected software

Vendor	Product	Versions
n/a	Modicon M580 Modicon M340 Modicon Quantum Modicon Premium	Modicon M580 Modicon M340 Modicon Quantum Modicon Premium

References

https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0763Exploit, Third Party Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0763Exploit, Third Party Advisory

Timeline

Published: May 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-78537.5A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium w CVE-2018-78547.5A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium wh CVE-2018-78557.5A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium wh CVE-2018-78567.5A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium w CVE-2018-78577.5A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium w CVE-2018-78585.5Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a deni CVE-2018-78596.1A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote at CVE-2018-78666.5A NULL pointer dereference was discovered in newVar3 in util/decompile.c in libming 0.4.8. The vulnerability causes a segmentation fault and CVE-2018-78676.5There is a heap-based buffer overflow in the getString function of util/decompile.c in libming 0.4.8 during a RegisterNumber sprintf. A Craf CVE-2018-78686.5There is a heap-based buffer over-read in the getName function of util/decompile.c in libming 0.4.8 for CONSTANT8 data. A Crafted input will CVE-2018-78697.5There is a memory leak triggered in the function dcinit of util/decompile.c in libming 0.4.8, which will lead to a denial of service attack.CVE-2018-78706.5An invalid memory address dereference was discovered in getString in util/decompile.c in libming 0.4.8 for CONSTANT16 data. The vulnerabilit