LiveActive security incident?Get immediate response
CVE Record

CVE-2018-7845: A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modic...

A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2018-7845 is a data exposure issue in several Schneider Electric Modicon controller families. A party able to read specific memory blocks over Modbus could receive unexpected controller data. For operators, the concern is loss of sensitive process or controller information that could support later attacks or operational reconnaissance.

Executive priority

Treat this as an OT exposure management issue, not a generic IT patch item. Priority is moderate by default, higher if affected controllers are remotely reachable, safety-critical, or connected to poorly segmented networks.

Technical view

The CVE describes a CWE-125 out-of-bounds read in all versions of Modicon M580, M340, Quantum, and Premium controllers. The trigger is reading specific controller memory blocks over Modbus, causing disclosure of unexpected data. The source bundle does not include CVSS, precise firmware fixes, or detailed vendor mitigation text.

Likely exposure

Exposure is most likely where affected Modicon controllers are reachable by untrusted networks, third-party remote access, flat OT segments, or broadly permitted Modbus traffic. Internet exposure would raise urgency, but the provided sources do not state that exposure is common.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation. Public references include Schneider Electric advisory SEVD-2019-134-11 and Talos report TALOS-2018-0745, indicating public technical awareness. Do not assume active exploitation from these sources alone.

Researcher notes

Evidence is sufficient for affected product families and vulnerability class, but incomplete for scoring, version-specific remediation, and operational workarounds. Validate against Schneider Electric’s advisory before making patch or compensating-control decisions.

Mitigation direction

  • Review Schneider Electric advisory SEVD-2019-134-11 for affected firmware and vendor guidance.
  • Restrict Modbus access to authorized engineering and supervisory systems only.
  • Isolate affected controllers from internet-facing and general corporate networks.
  • Monitor OT networks for unusual or unauthorized Modbus memory reads.
  • Prioritize remediation for safety-critical or remotely reachable controller environments.

Validation and detection

  • Inventory Modicon M580, M340, Quantum, and Premium controllers in OT environments.
  • Confirm firmware and model status against Schneider Electric advisory SEVD-2019-134-11.
  • Map all systems permitted to communicate with controllers over Modbus.
  • Check firewall and segmentation rules for unnecessary Modbus reachability.
  • Review OT monitoring data for unexpected controller memory access patterns.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-7845 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aModicon M580 Modicon M340 Modicon Quantum Modicon PremiumModicon M580 Modicon M340 Modicon Quantum Modicon PremiumListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.