Design/Logic Flaw

2021-06-1116:15:00

PRIOn knowledge base

www.prio-n.com

5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.9%

JSON

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could cause information leak concerning the current RTU configuration including communication parameters dedicated to telemetry, when a specially crafted HTTP request is sent to the web server of the module.

CPENameOperatorVersion
modicon_x80_bmxnor0200h_rtu_firmwareeqsv1.6 ir4
modicon_x80_bmxnor0200h_rtu_firmwareeqsv1.7 ir19
modicon_x80_bmxnor0200h_rtu_firmwareeqsv1.7 ir18
modicon_x80_bmxnor0200h_rtu_firmwareeqsv1.7 ir17
modicon_x80_bmxnor0200h_rtu_firmwareeqsv1.7 ir10
modicon_x80_bmxnor0200h_rtu_firmwareeqsv1.7 ir15b
modicon_x80_bmxnor0200h_rtu_firmwareeqsv1.7 ir20

Name	Operator	Version
modicon_x80_bmxnor0200h_rtu_firmware	eq	sv1.6 ir4
modicon_x80_bmxnor0200h_rtu_firmware	eq	sv1.7 ir19
modicon_x80_bmxnor0200h_rtu_firmware	eq	sv1.7 ir18
modicon_x80_bmxnor0200h_rtu_firmware	eq	sv1.7 ir17
modicon_x80_bmxnor0200h_rtu_firmware	eq	sv1.7 ir10
modicon_x80_bmxnor0200h_rtu_firmware	eq	sv1.7 ir15b
modicon_x80_bmxnor0200h_rtu_firmware	eq	sv1.7 ir20

References

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05