The vulnerability of the microprogramming software used in Schneider Electric Modicon programmable logic controllers lies in the insufficient checking of unusual or exceptional states. This allows a intruder to trigger a malfunction of the Web server service.

The vulnerability of the microprogramming software used in Schneider Electric’s Modicon programmable logic controllers is related to insufficient testing of unusual or exceptional states. Exploiting this vulnerability could allow an intruder to cause a failure in the web server service by sending...

The vulnerability of the microprogrammed software of Schneider Electric Modicon programmable logic controllers, related to the lack of necessary checks during password changes, allows unauthorized access to the password-changing function of the web server.

The vulnerability of the microprogrammed logic controllers from Schneider Electric Modicon lies in the lack of necessary checks during password changes. Exploiting this vulnerability could allow unauthorized individuals to gain access to the password-changing function of the web server...

The vulnerability of Modicon microprogrammed control devices, related to insufficient verification of input data, allows attackers to redirect users to malicious websites.

The vulnerability of Modicon controller microprogramming software is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to redirect users to a malicious website remotely...

The vulnerability of the microprogramming software of Schneider Electric’s Modicon M221 programmable logic controller stems from errors in the implementation of the network module in the UMAS protocol. This vulnerability allows a hacker to intercept the network traffic of the controller.

The vulnerability of the microprogramming software of Schneider Electric’s Modicon M221 programmable logic controller is related to the incorrect implementation of the network module in the UMAS protocol. Exploiting this vulnerability allows a malicious actor to intercept the controller’s network...

Schneider Electric Modicon M340, Premium, Quantum PLC and BMXNOR0200 Information Disclosure Vulnerability

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. An information disclosure vulnerability exists in the embedded web server in the Modicon M340, Premium, Quantum PLC, and BMXNOR0200, which can be exploited by an attacker to obtain...

Information disclosure

An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses in a way that exposes security-relevant information about the state of the product, such as whether...

CVE-2018-7812

An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses in a way that exposes security-relevant information about the state of the product, such as whether...

CVE-2018-7833

An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can send a specially crafted XML data via a POST request to cause the web server to become unavailable...

Design/Logic Flaw

A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user clicking on a specially crafted link can be redirected to a URL of the attacker's choosing...

Input validation

An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can send a specially crafted XML data via a POST request to cause the web server to become unavailable...

CVE-2018-7833

CVE-2018-7833 affects the embedded web servers in Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. A vulnerability described as an improper check for unusual or exceptional conditions allows an unauthenticated remote attacker to send specially crafted XML data via a POST req...

CVE-2018-7833

An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can send a specially crafted XML data via a POST request to cause the web server to become unavailable...

CVE-2018-7804

A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user clicking on a specially crafted link can be redirected to a URL of the attacker's choosing...

CVE-2018-7812

CVE-2018-7812 affects Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The embedded web servers expose security-relevant information by returning different responses (information-disclosure via discrepancy), revealing state or operation outcomes. Affects confidentiality (par...

CVE-2018-7804

CVE-2018-7804 affects Schneider Electric Modicon devices: M340, Premium, Quantum PLCs and BMXNOR0200 with embedded web servers. The vulnerability is a URL redirection to an untrusted site triggered when a user clicks a specially crafted link. The issue is an open redirect in the web interface, en...

Unspecified Vulnerability in Multiple Schneider Electric Products

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. An unspecified vulnerability exists in several Schneider Electric products. An attacker could use this vulnerability to delete or reset existing usernames and passwords...

Design/Logic Flaw

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...

CVE-2018-7811

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...

Crlf injection

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for 1 minute by sending a specially crafted HTTP request...

CVE-2018-7809

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server...