PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-7842 Schneider Electric CVE debrief

CVE-2018-7842 is an authentication-bypass-by-spoofing issue affecting Schneider Electric Modicon controllers and related firmware. The advisory says an attacker could brute-force Modbus parameters sent to the controller and gain elevated privilege. Schneider Electric provides firmware fixes for some affected lines, while Quantum, Quantum Safety, and Premium products are end-of-life and rely on mitigation plus migration guidance.

Vendor
Schneider Electric
Product
Modicon M580 Controller
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2019-05-14
Original CVE updated
2026-04-23
Advisory published
2019-05-14
Advisory updated
2026-04-23

Who should care

Industrial control system owners, OT engineers, plant operators, and integrators using Schneider Electric Modicon M580, M340, Quantum, Quantum Safety, or Premium controllers or their firmware. Priority is highest where Modbus/TCP is reachable, where controller programming or engineering workstations are connected, or where legacy/EOL products remain in service.

Technical summary

The source advisory describes an authentication bypass by spoofing vulnerability that can be abused through brute force attempts against Modbus parameters sent to the controller. The affected scope in the supplied CSAF includes Modicon M580 firmware prior to v2.90, Modicon M340 firmware prior to v3.10, and all versions of Modicon Quantum, Quantum Safety, and Premium firmware. Schneider Electric lists fixed versions for M580 (SV4.20 or above) and M340 (v3.60 or above), along with project updates in EcoStruxure Control Expert, application passwords, and project rebuild/transfer steps. For Quantum, Quantum Safety, and Premium, the vendor states the products are end-of-life and recommends migration plus mitigations such as network segmentation, firewall restrictions on port 502/TCP, ACL configuration, and secure communications/IPsec guidance.

Defensive priority

High. Treat as urgent for any exposed OT environment, especially if Modbus/TCP is reachable from non-trusted networks or if legacy controllers are still deployed.

Recommended defensive actions

  • Update Modicon M580 controllers to firmware SV4.20 or above and EcoStruxure Control Expert to v16.0 as instructed by the vendor.
  • Update Modicon M340 controllers to firmware v3.60 or above and EcoStruxure Control Expert to v16.0 or later.
  • Set an application password in EcoStruxure Control Expert project properties for affected projects.
  • Rebuild and transfer projects after updating firmware and controller version settings.
  • Restrict or block unauthorized access to TCP port 502 using network segmentation and firewalls.
  • Configure ACLs and secure communications per Schneider Electric guidance, including IPsec where applicable.
  • For Quantum, Quantum Safety, and Premium products, plan migration because the vendor states there is no fix planned for these end-of-life lines.
  • Verify controller and workstation versions against the Schneider Electric advisory before scheduling maintenance windows.

Evidence notes

The supplied source item is Schneider Electric/CISA CSAF advisory ICSA-25-114-01 for CVE-2018-7842, published 2019-05-14 and revised multiple times afterward. The advisory identifies affected Modicon M580, M340, Quantum, Quantum Safety, and Premium product lines. Remediations in the source corpus name fixed firmware for M580 and M340, and mitigation/migration guidance for Quantum, Quantum Safety, and Premium. The supplied data also includes a CVSS v3.1 vector/score and a CVSS v4.0 score in the description; both are retained as source context without reconciliation beyond what is explicitly supplied.

Official resources

Publicly disclosed in the source advisory on 2019-05-14. No Known Exploited Vulnerabilities (KEV) listing is supplied for this CVE in the provided corpus.