The vulnerability of microprogrammed software in Modicon, ATV IMC, and PacDrive programmable logic controllers lies in the lack of authentication for a critical function, allowing an intruder to alter the device’s configuration.

🗓️ 14 Jun 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 11 Views

No authentication for a critical function in Modicon, ATV IMC, PacDrive PLCs enables remote IP configuration changes.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of microprogrammed programmable logic controllers like Modicon and PacDrive lies in the lack of authentication for a critical function. This allows attackers to alter the device’s IP configuration.	30 Aug 202100:00	–	bdu_fstec
Circl	CVE-2019-6820	22 May 201920:48	–	circl
CNVD	Access Control Error Vulnerability in Multiple Schneider Electric Products	22 May 201900:00	–	cnvd
CVE	CVE-2019-6820	22 May 201919:40	–	cve
Cvelist	CVE-2019-6820	22 May 201919:40	–	cvelist
EUVD	EUVD-2019-16374	7 Oct 202500:30	–	euvd
NVD	CVE-2019-6820	22 May 201920:29	–	nvd
Tenable Nessus	Schneider-electric Modicon Missing Authentication for Critical Function	8 Nov 201900:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Missing Authentication for Critical Function (CVE-2019-6820)	1 Mar 202300:00	–	nessus
Prion	Authentication flaw	22 May 201920:29	–	prion

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-6820
schneider-electric	www.schneider-electric.com/en/download/document/SEVD-2019-134-02/
web	www.web.nvd.nist.gov/view/vuln/detail

23 Mar 2021 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 26.4

CVSS 38.2

EPSS0.0125

authentication missing modicon programmable logic controller atv imc programmable logic controller pacdrive programmable logic controller remote configuration changes ip address network mask server ip address