Skip to content
Fencer Vulns
high 7.5

CVE-2018-7838 json

A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENO…

published 2019-07-15 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-19550

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP CWD command with a data length greater than 1020 bytes. A power cycle is then needed to reactivate the FTP service.

Patch / fix

  • schneider-electric bmenoc0301_firmware 2.16
  • schneider-electric modicon_m580_bmep584040_firmware 2.90
  • schneider-electric modicon_m580_bmep586040_firmware 2.90
  • schneider-electric bmeh586040_firmware 2.90
  • schneider-electric modicon_m580_bmep581020_firmware 2.90
  • schneider-electric modicon_m580_bmep582020_firmware 2.90
  • schneider-electric modicon_m580_bmep582040_firmware 2.90
  • schneider-electric modicon_m580_bmep583020_firmware 2.90
  • schneider-electric modicon_m580_bmep583040_firmware 2.90
  • schneider-electric modicon_m580_bmep584020_firmware 2.90
  • schneider-electric modicon_m580_bmep585040_firmware 2.90
  • schneider-electric modicon_m580_bmep582040s_firmware 2.90
  • schneider-electric bmeh582040_firmware 2.90

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • Modicon Modicon M580 CPU - BMEP582040 all versions before V2.90 and Modicon Ethernet Module BMENOC0301 all versions before V2.16

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.