CVE-2018-7789

Vulnerability

The vulnerability is an Improper Check for Unusual or Exceptional Conditions (CWE-754) in Schneider Electric's Modicon M221 programmable logic controller (PLC). All references and versions prior to firmware V1.6.2.0 are affected. The bug resides in the handling of programming protocol frames, where the device fails to properly validate certain conditions, allowing an attacker to trigger a reboot [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending specially crafted programming protocol frames to the Modicon M221 device. No authentication is required, but the attack requires high complexity due to the need to craft specific frames. The attacker must have network access to the PLC, and no user interaction is needed [1].

Impact

Successful exploitation allows an unauthorized user to remotely reboot the Modicon M221 PLC. This results in a denial of service (availability impact) and potentially a low integrity impact as the device state may be disrupted. The confidentiality is not affected. The CVSS v3 base score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) [1].

Mitigation

Schneider Electric has released a fix in firmware version V1.6.2.0, delivered via SoMachine Basic v1.6 SP2 or the Schneider Electric Software Update tool. Users should update to the latest firmware. As a workaround, minimize network exposure of the PLCs, place them behind firewalls, and isolate control system networks from business networks. The advisory is available at the Schneider Electric security notification [1].