#VU18675 Use of insufficiently random values in Schneider Electric products - CVE-2019-6821

Published: 2019-06-05 | Updated: 2019-10-03

Vulnerability identifier: #VU18675

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-6821

CWE-ID: CWE-330

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Modicon Quantum
Hardware solutions / Firmware
Modicon Premium
Hardware solutions / Firmware
Modicon M340
Hardware solutions / Firmware
Modicon M580
Hardware solutions / Firmware

Vendor: Schneider Electric

Description

The vulnerability allows a remote attacker to guess the next generated value and impersonate another user or access sensitive information.

The vulnerability exists due to the device has predictable TCP initial sequence numbers.

A remote attacker can hijack TCP connection carrying unsecured communication and cause information leakage.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

A vendor recommends to:

Modicon M340:

Schneider Electric recommends that affected users set up network segmentation and implement a firewall to block all remote/external access to TCP ports. Configure the Access Control List following the recommendations of the user manual Modicon M340 for Ethernet Communications Modules and Processors User Manual, in the chapter titled Messaging
Configuration Parameters, which is available here: https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=31007131_K01_000_16.pdf&p_Doc_Ref=31007131K01000

Modicon Premium and Modicon Quantum:

Set up network segmentation and implement a firewall to block all unauthorized access to all TCP ports.

Vulnerable software versions

Modicon Quantum: All versions

Modicon Premium: All versions

Modicon M340: All versions

Modicon M580: 1.04 - 2.20

External links
https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-134-03+-+Modicon+Controller.pdf&p_Doc_Ref=SEVD-2019-134-03

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.