CVE-2017-6017
high-risk
Published 2017-06-30
A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMXP342000, BMXP3420102, BMXP3420102CL, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H. A remote attacker could send a specially crafted set of packets to the PLC causing it to freeze, requiring the operator to physically press the reset button on the PLC in order to recover.
Do I need to act?
~
5.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Products (15)
Bmxnoe0100 Firmware
Bmxnoe0110H Firmware
Bmxnor0200H Firmware
Modicon M340 Bmxp3420102Cl Firmware
Modicon M340 Bmxp3420302H Firmware
Modicon M340 Bmxp342030H Firmware
Bmxnoc0401 Firmware
Bmxnoe0110 Firmware
Modicon M340 Bmxp342020H Firmware
Modicon M340 Bmxp342030 Firmware
Affected Vendors
References (6)
Third Party Advisory
http://www.securityfocus.com/bid/96414
Third Party Advisory
http://www.securityfocus.com/bid/96414
52
/ 100
high-risk
Severity
26/34 · High
Exploitability
8/34 · Low
Exposure
18/34 · Moderate