Lucene search

[email protected]CVE-2015-6461

HistoryMar 21, 2019 - 7:29 p.m.

CVE-2015-6461

2019-03-2119:29:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2015-6461

remote file inclusion

schneider electric

modicon plc

web server

security vulnerability

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.4 Medium

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

31.9%

JSON

Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.

CPENameOperatorVersion
schneider-electric:bmxnoc0401_firmwareschneider-electric bmxnoc0401 firmwareeq-
schneider-electric:bmxnoe0100_firmwareschneider-electric bmxnoe0100 firmwareeq-
schneider-electric:bmxnoe0110_firmwareschneider-electric bmxnoe0110 firmwareeq-
schneider-electric:bmxnoe0110h_firmwareschneider-electric bmxnoe0110h firmwareeq-
schneider-electric:bmxnor0200h_firmwareschneider-electric bmxnor0200h firmwareeq-
schneider-electric:modicon_m340_bmxp342020_firmwareschneider-electric modicon m340 bmxp342020 firmwareeq-
schneider-electric:modicon_m340_bmxp342020h_firmwareschneider-electric modicon m340 bmxp342020h firmwareeq-
schneider-electric:modicon_m340_bmxp342030_firmwareschneider-electric modicon m340 bmxp342030 firmwareeq-
schneider-electric:modicon_m340_bmxp3420302_firmwareschneider-electric modicon m340 bmxp3420302 firmwareeq-
schneider-electric:modicon_m340_bmxp3420302h_firmwareschneider-electric modicon m340 bmxp3420302h firmwareeq-

CPE	Name	Operator	Version
schneider-electric:bmxnoc0401_firmware	schneider-electric bmxnoc0401 firmware	eq	-
schneider-electric:bmxnoe0100_firmware	schneider-electric bmxnoe0100 firmware	eq	-
schneider-electric:bmxnoe0110_firmware	schneider-electric bmxnoe0110 firmware	eq	-
schneider-electric:bmxnoe0110h_firmware	schneider-electric bmxnoe0110h firmware	eq	-
schneider-electric:bmxnor0200h_firmware	schneider-electric bmxnor0200h firmware	eq	-
schneider-electric:modicon_m340_bmxp342020_firmware	schneider-electric modicon m340 bmxp342020 firmware	eq	-
schneider-electric:modicon_m340_bmxp342020h_firmware	schneider-electric modicon m340 bmxp342020h firmware	eq	-
schneider-electric:modicon_m340_bmxp342030_firmware	schneider-electric modicon m340 bmxp342030 firmware	eq	-
schneider-electric:modicon_m340_bmxp3420302_firmware	schneider-electric modicon m340 bmxp3420302 firmware	eq	-
schneider-electric:modicon_m340_bmxp3420302h_firmware	schneider-electric modicon m340 bmxp3420302h firmware	eq	-

Rows per page:

1-10 of 111

References

ics-cert.us-cert.gov/advisories/ICSA-15-246-02

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.4 Medium

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

31.9%

JSON

Related for CVE-2015-6461

cvelist1 prion1 nessus1 ics1