PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-7850 Schneider Electric CVE debrief

CVE-2018-7850 is a Schneider Electric industrial control system vulnerability where untrusted inputs were relied on in a security decision, which could cause invalid information to be displayed in Unity Pro software. The supplied advisory data ties the issue to multiple Modicon controller families, not just the M580 title product, and provides fixes for some lines while leaving end-of-life products on mitigation-only guidance. The original disclosure date in the source corpus is 2019-05-14.

Vendor
Schneider Electric
Product
Modicon M580 Firmware Versions prior to v2.90 installed on Modicon M580 Controller
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2019-05-14
Original CVE updated
2026-04-23
Advisory published
2019-05-14
Advisory updated
2026-04-23

Who should care

OT and ICS operators, plant engineers, system integrators, and defenders responsible for Schneider Electric Modicon environments—especially sites using EcoStruxure Control Expert/Unity Pro, exposed controller networks, or Modbus TCP services.

Technical summary

The vulnerability is described as a reliance on untrusted inputs in a security decision, resulting in invalid information being displayed in Unity Pro software. The CISA CSAF record maps the issue to Schneider Electric Modicon M580 firmware prior to v2.90, Modicon M340 firmware prior to v3.10, and end-of-life Quantum, Quantum Safety, and Premium controller families. Vendor remediation is available for M580 (SV4.20 or above) and M340 (v3.60 or above), while Quantum/Quantum Safety and Premium are listed as no-fix-planned with mitigation guidance only. The supplied corpus also includes CVSS data indicating a high-severity impact focused on integrity.

Defensive priority

High. Prioritize exposed or operationally critical Schneider Electric controller deployments first, especially M580 and M340 systems that can be updated, and apply network/access restrictions immediately on end-of-life platforms.

Recommended defensive actions

  • Update Schneider Electric Modicon M580 firmware to SV4.20 or later and EcoStruxure Control Expert to v16.0 as directed by the vendor.
  • Update Schneider Electric Modicon M340 firmware to v3.60 or later and use the corresponding EcoStruxure Control Expert version recommended in the advisory.
  • Set an application password in project properties, rebuild affected projects, and transfer them again after applying the vendor fix.
  • Restrict access to controller networks: segment OT networks, block unauthorized access to TCP port 502, and apply ACLs per Schneider Electric guidance.
  • For Quantum, Quantum Safety, and Premium systems, treat the advisory as mitigation-only and plan migration off end-of-life products.
  • Review secured communications guidance such as IPsec and firewall/VPN options referenced in the vendor notice for M580/M340 architectures.
  • Verify affected engineering workstations and controller firmware versions against the advisory before maintenance windows to avoid incomplete remediation.

Evidence notes

The source corpus states the vulnerability as untrusted-input reliance causing invalid information in Unity Pro, and the CISA CSAF advisory revision history records the original release on 2019-05-14. The same advisory lists product-specific fixes for M580 and M340 and mitigation-only guidance for Quantum, Quantum Safety, and Premium because those lines are end of life. The supplied metadata also contains mixed CVSS representations: a CVSS v4.0 high-severity score in the CVE summary and a CVSS v3.1 vector in the CSAF record; this debrief reflects both without inferring anything beyond the source corpus.

Official resources

Publicly disclosed on 2019-05-14 in Schneider Electric’s SEVD-2019-134-11 notice; the CISA CSAF record in the corpus preserves that original release date and later revisions.