CVE-2011-4860

2022-10-0316:15:13

CWE-287

[email protected]

web.nvd.nist.gov

cve-2011-4860

schneider electric

quantum ethernet module

noe 771

fwupgrade account

arp request

neighbor solicitation

remote access

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

6.8 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.5%

JSON

The ComputePassword function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device (aka the Quantum 140NOE771* module) generates the password for the fwupgrade account by performing a calculation on the MAC address, which makes it easier for remote attackers to obtain access via a (1) ARP request message or (2) Neighbor Solicitation message.

Affected configurations

NVD

Node

schneider-electricquantum_ethernet_module_140noe77100Range≤3.3

schneider-electricquantum_ethernet_module_140noe77100Range≤3.4

schneider-electricquantum_ethernet_module_140noe77101Range≤4.9

schneider-electricquantum_ethernet_module_140noe77111Range≤5.0

CPENameOperatorVersion
schneider-electric:quantum_ethernet_module_140noe77100schneider-electric quantum ethernet module 140noe77100le3.3
schneider-electric:quantum_ethernet_module_140noe77100schneider-electric quantum ethernet module 140noe77100le3.4
schneider-electric:quantum_ethernet_module_140noe77101schneider-electric quantum ethernet module 140noe77101le4.9
schneider-electric:quantum_ethernet_module_140noe77111schneider-electric quantum ethernet module 140noe77111le5.0

CPE	Name	Operator	Version
schneider-electric:quantum_ethernet_module_140noe77100	schneider-electric quantum ethernet module 140noe77100	le	3.3
schneider-electric:quantum_ethernet_module_140noe77100	schneider-electric quantum ethernet module 140noe77100	le	3.4
schneider-electric:quantum_ethernet_module_140noe77101	schneider-electric quantum ethernet module 140noe77101	le	4.9
schneider-electric:quantum_ethernet_module_140noe77111	schneider-electric quantum ethernet module 140noe77111	le	5.0