Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.9

Modicon controllers can crash FTP service during firmware upgrade

CVE-2019-6847 · published 7 years ago
Summary

The Modicon M580, M340, BMxCRA and 140CRA controllers may stop responding to FTP connections if an incompatible firmware version is uploaded. This can temporarily block remote updates and maintenance. Use only firmware versions that match the controller’s application and verify compatibility before upgrading.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
schneider-electric modicon_m580_firmware All versions
cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*
schneider-electric modicon_m340_firmware All versions
cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*
schneider-electric modicon_bmxcra_firmware All versions
cpe:2.3:o:schneider-electric:modicon_bmxcra_firmware:*:*:*:*:*:*:*:*
schneider-electric modicon_140cra_firmware All versions
cpe:2.3:o:schneider-electric:modicon_140cra_firmware:*:*:*:*:*:*:*:*
Original advisory text
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of S...
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the FTP service when upgrading the firmware with a version incompatible with the application in the controller using FTP protocol.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-755Improper Handling of Exceptional Conditions
Timeline
Published29 Oct 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-6847 · NVD
Track software like this
Free during beta