PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-7849 Schneider Electric CVE debrief

CVE-2018-7849 affects Schneider Electric Modicon controller families and can lead to a denial of service when files are sent to the controller over Modbus. The source advisory describes the root cause as an uncaught exception tied to an improper data integrity check. For some product lines, fixed firmware is available; for end-of-life lines, Schneider Electric recommends migration and network mitigations.

Vendor
Schneider Electric
Product
Modicon M580 Controller
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2019-05-14
Original CVE updated
2026-04-23
Advisory published
2019-05-14
Advisory updated
2026-04-23

Who should care

OT/ICS owners, control engineers, and defenders responsible for Schneider Electric Modicon M580, M340, Quantum, Quantum Safety, and Premium environments should care most. This also matters to teams managing EcoStruxure Control Expert project transfers and any plant network where Modbus access is not tightly restricted.

Technical summary

The CISA CSAF source for ICSA-25-114-01 states that sending files to the controller over Modbus can trigger an uncaught exception because of improper data integrity checking, resulting in availability loss. The advisory maps the issue to network-based exploitation with no privileges and no user interaction required, and the impact is denial of service rather than confidentiality or integrity compromise. Remediation is version-dependent: M580 has a fixed release at SV4.20 or above, M340 at v3.60 or above, while Quantum Safety and Premium are end-of-life and rely on mitigations rather than a vendor fix.

Defensive priority

High. Prioritize systems that are remotely reachable, share flat OT networks, or allow Modbus file-transfer activity. Patch M580 and M340 first where supported, then enforce segmentation and port 502/TCP restrictions across all affected lines, especially end-of-life Quantum and Premium assets.

Recommended defensive actions

  • Inventory affected Schneider Electric assets and confirm firmware versions for M580, M340, Quantum, Quantum Safety, and Premium controllers.
  • Update Modicon M580 controllers to firmware SV4.20 or later and update EcoStruxure Control Expert as directed by Schneider Electric before rebuilding and transferring projects.
  • Update Modicon M340 controllers to firmware v3.60 or later and align engineering workstation projects with the target firmware version.
  • For Quantum Safety and Premium controllers, plan migration to supported platforms and apply the vendor mitigations because no fix is planned.
  • Restrict Modbus access to trusted engineering and control segments; block unauthorized access to port 502/TCP with firewalls and segmentation.
  • Configure application passwords and access control lists as recommended in the Schneider Electric manuals linked from the advisory.
  • Use the vendor-guided secure-communication options, including IPsec or approved external firewall/VPN approaches where applicable.
  • Verify change windows and test controller/project transfers after remediation to avoid operational disruption.

Evidence notes

The primary source corpus is the CISA CSAF advisory item ICSA-25-114-01, originally released on 2019-05-14, which states: 'An uncaught exception vulnerability exists which could cause a possible denial of service due to improper data integrity check when sending files to the controller over Modbus.' The same source lists affected product families and remediation paths, including M580 firmware prior to v2.90, M340 firmware prior to v3.10, Quantum and Quantum Safety all versions, and Premium all versions. Schneider Electric's referenced security notice and the CISA advisory landing page corroborate the issue and remediation guidance. The corpus also contains both a CVSS v4.0 statement in the description and a CVSS v3.1 vector/score in the CSAF metadata; this debrief preserves that distinction rather than normalizing the scores.

Official resources

CVE-2018-7849 was originally published on 2019-05-14 in the CISA CSAF source. The advisory was revised later to add or refine remediation guidance, but those later updates do not change the original CVE publication date.