Skip to main content

Bmxnoc0401 Firmware CVE-2017-6017

HIGH
Uncontrolled Resource Consumption (CWE-400)
2017-06-30 ics-cert@hq.dhs.gov
Denial Of Service Schneider Electric Bmxnoc0401 Firmware Bmxnoe0100 Firmware Bmxnoe0110 Firmware Bmxnoe0110H Firmware Bmxnor0200H Firmware Modicon M340 Bmxp341000 Firmware Modicon M340 Bmxp342000 Firmware Modicon M340 Bmxp3420102 Firmware Modicon M340 Bmxp3420102Cl Firmware Modicon M340 Bmxp342020 Firmware Modicon M340 Bmxp342020H Firmware Modicon M340 Bmxp342030 Firmware Modicon M340 Bmxp3420302 Firmware Modicon M340 Bmxp3420302H Firmware Modicon M340 Bmxp342030H Firmware
7.5
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 30, 2017 - 03:29 cve.org
HIGH 7.5

DescriptionCVE.org

A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMXP342000, BMXP3420102, BMXP3420102CL, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H. A remote attacker could send a specially crafted set of packets to the PLC causing it to freeze, requiring the operator to physically press the reset button on the PLC in order to recover.

AnalysisAI

A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMXP342000, BMXP3420102, BMXP3420102CL,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMXP342000, BMXP3420102, BMXP3420102CL, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H. A remote attacker could send a specially crafted set of packets to the PLC causing it to freeze, requiring the operator to physically press the reset button on the PLC in order to recover. Affected products include: Schneider-Electric Bmxnoc0401 Firmware, Schneider-Electric Bmxnoe0100 Firmware, Schneider-Electric Bmxnoe0110 Firmware, Schneider-Electric Bmxnoe0110H Firmware, Schneider-Electric Bmxnor0200H Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.

More in Bmxnoc0401 Firmware

View all
CVE-2020-7540 CRITICAL
9.8 Dec 11

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy O
CVE-2020-7533 CRITICAL
9.8 Dec 01

commands on the webserver without authentication when sending specially crafted HTTP requests. Rated critical severity (
CVE-2020-7534 HIGH
8.8 Feb 04

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sen
CVE-2021-22788 HIGH
7.5 Feb 11

A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a speciall
CVE-2021-22787 HIGH
7.5 Feb 11

A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attack
CVE-2021-22785 HIGH
7.5 Feb 11

A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web

CVE-2020-7539 HIGH
7.5 Dec 11

A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, L
CVE-2020-7549 MEDIUM
5.3 Dec 11

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340,

CVE-2020-7541 MEDIUM
5.3 Dec 11

A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modi

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2026-45498 MEDIUM POC
4.0
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5
CVE-2025-27469 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2017-6017 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy