CVE-2011-4861

2022-10-0316:15:13

CWE-264

[email protected]

web.nvd.nist.gov

cve-2011-4861

schneider electric

quantum ethernet module

noe 771

firmware update

modbus 125

tcp port 502

remote attack

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

7.1 High

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

83.2%

JSON

The modbus_125_handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device (aka the Quantum 140NOE771* module) allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code to TCP port 502.

Affected configurations

NVD

Node

schneider-electricquantum_ethernet_module_140noe77100Range≤3.3

schneider-electricquantum_ethernet_module_140noe77100Range≤3.4

schneider-electricquantum_ethernet_module_140noe77101Range≤4.9

schneider-electricquantum_ethernet_module_140noe77111Range≤5.0

CPENameOperatorVersion
schneider-electric:quantum_ethernet_module_140noe77100schneider-electric quantum ethernet module 140noe77100le3.3
schneider-electric:quantum_ethernet_module_140noe77100schneider-electric quantum ethernet module 140noe77100le3.4
schneider-electric:quantum_ethernet_module_140noe77101schneider-electric quantum ethernet module 140noe77101le4.9
schneider-electric:quantum_ethernet_module_140noe77111schneider-electric quantum ethernet module 140noe77111le5.0

CPE	Name	Operator	Version
schneider-electric:quantum_ethernet_module_140noe77100	schneider-electric quantum ethernet module 140noe77100	le	3.3
schneider-electric:quantum_ethernet_module_140noe77100	schneider-electric quantum ethernet module 140noe77100	le	3.4
schneider-electric:quantum_ethernet_module_140noe77101	schneider-electric quantum ethernet module 140noe77101	le	4.9
schneider-electric:quantum_ethernet_module_140noe77111	schneider-electric quantum ethernet module 140noe77111	le	5.0