7.5
HIGH
CVE-2019-6856
Modicon Denial of Service (DoS) Bug
Description

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service when writing specific physical memory blocks using Modbus TCP.

INFO

Published Date :

Jan. 6, 2020, 11:15 p.m.

Last Modified :

Feb. 3, 2022, 3:18 p.m.

Remotely Exploitable :

Yes !

Impact Score :

3.6

Exploitability Score :

3.9
Affected Products

The following products are affected by CVE-2019-6856 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Schneider-electric 140cpu65150_firmware
2 Schneider-electric 140cpu65160_firmware
3 Schneider-electric modicon_m580_firmware
4 Schneider-electric modicon_m340_firmware
5 Schneider-electric tsxp574634m_firmware
6 Schneider-electric tsxp575634m_firmware
7 Schneider-electric tsxp576634m_firmware
8 Schneider-electric tsxp571634m_firmware
9 Schneider-electric tsxp572634m_firmware
10 Schneider-electric tsxp573634m_firmware
11 Schneider-electric 140cpu65260_firmware
12 Schneider-electric 140cpu65860_firmware
13 Schneider-electric 140cpu65160s_firmware
14 Schneider-electric tsxh5724m_firmware
15 Schneider-electric tsxh5744m_firmware
16 Schneider-electric tsxp57104m_firmware
17 Schneider-electric tsxp57154m_firmware
18 Schneider-electric tsxp57204m_firmware
19 Schneider-electric tsxp57254m_firmware
20 Schneider-electric tsxp57304m_firmware
21 Schneider-electric tsxp57354m_firmware
22 Schneider-electric tsxp57454m_firmware
23 Schneider-electric tsxp57554m_firmware
24 Schneider-electric 140cpu67261_firmware
25 Schneider-electric 140cpu67060_firmware
26 Schneider-electric 140cpu67160_firmware
27 Schneider-electric 140cpu67260_firmware
28 Schneider-electric 140cpu67861_firmware
29 Schneider-electric 140cpu67160s_firmware
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2019-6856.

URL Resource
https://www.se.com/ww/en/download/document/SEVD-2019-344-01 Vendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-016-01 Third Party Advisory US Government Resource

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2019-6856 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2019-6856 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Modified Analysis by [email protected]

    Feb. 03, 2022

    Action Type Old Value New Value
    Changed Reference Type https://www.us-cert.gov/ics/advisories/icsa-20-016-01 No Types Assigned https://www.us-cert.gov/ics/advisories/icsa-20-016-01 Third Party Advisory, US Government Resource
    Changed CPE Configuration AND OR *cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.01 OR cpe:2.3:h:se:modicon_m340:-:*:*:*:*:*:*:* AND OR *cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.01 OR cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Jan. 31, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:* OR *cpe:2.3:h:se:modicon_m340:-:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Jan. 31, 2022

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:h:se:modicon_m340:-:*:*:*:*:*:*:* OR *cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Aug. 19, 2021

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:* OR *cpe:2.3:h:se:modicon_m340:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jan. 22, 2020

    Action Type Old Value New Value
    Added Reference https://www.us-cert.gov/ics/advisories/icsa-20-016-01 [No Types Assigned]
  • Initial Analysis by [email protected]

    Jan. 14, 2020

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:N/AC:L/Au:N/C:N/I:N/A:P)
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    Changed Reference Type https://www.se.com/ww/en/download/document/SEVD-2019-344-01 No Types Assigned https://www.se.com/ww/en/download/document/SEVD-2019-344-01 Vendor Advisory
    Added CWE NIST CWE-754
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.80 OR cpe:2.3:h:schneider-electric:modicon_m580:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.01 OR cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxh5744m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxh5744m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxh5724m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxh5724m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp576634m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp576634m_:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp57554m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp57554m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp575634m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp575634m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp57454m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp57454m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp574634m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp574634m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp57354m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp57354m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp573634m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp573634m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp57304m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp57304m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp57254m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp57254m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp572634m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp572634m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp57204m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp57204m_:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp571634m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp571634m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp57154m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp57154m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:tsxp57104m_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.20 OR cpe:2.3:h:schneider-electric:tsxp57104m:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu65150_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu65150:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu65160_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu65160:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu65260_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu65260:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu67261_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu67261:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu67060_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu67060:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu67160_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu67160:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu67261_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu67261:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu67260_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu67260:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu65860_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu65860:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu67861_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu67861:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu65160s_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu65160s:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:schneider-electric:140cpu67160s_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 3.52 OR cpe:2.3:h:schneider-electric:140cpu67160s:-:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2019-6856 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2019-6856 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.11 }} 0.00%

score

0.42828

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability