639 matches found
Schneider Electric Modicon Controllers and Software Authentication Bypass By Spoofing (CVE-2021-22779)
Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, SCADAPack...
Schneider Electric Modicon Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-7809)
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server. This plugin only works with Tenable.ot. Please visit...
Schneider Electric Modicon Improper Check for Unusual or Exceptional Conditions (CVE-2020-7543)
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...
Schneider Electric Modicon Improper Handling of Exceptional Conditions (CVE-2019-6843)
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware version prior to V3.10, Modicon M340 all firmware versions, and Modicon BMxCRA and 140CRA modules all firmware versions, which could cause a Denial of Service attack on the PLC when upgrading...
Schneider Electric Modicon Controllers Out-of-Bounds Read (CVE-2018-7845)
A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus. This plugin only...
CVE-2022-22724
A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 HTTP and 502 Modbus, when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 All Versions...
CVE-2022-22724
A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 HTTP and 502 Modbus, when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 All Versions...
CVE-2020-7534
A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 All Versions, Modicon Quantum CPUs with...
Denial of service
A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 HTTP and 502 Modbus, when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 All Versions...
Cross site request forgery (csrf)
A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 All Versions, Modicon Quantum CPUs with...
CVE-2022-22724
CVE-2022-22724 affects Schneider Electric Modicon M340 BMXP34 controllers (all versions). The root cause is CWE-400 Uncontrolled Resource Consumption, enabling a denial of service by flooding TCP ports 80 (HTTP) and 502 (Modbus) with a large number of RST/FIN packets to any open TCP port. Documen...
CVE-2020-7534
A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 All Versions, Modicon Quantum CPUs with...
CVE-2020-7534
CVE-2020-7534 is a CSRF vulnerability affecting Schneider Electric Modicon web servers. Affected products include M340 BMXP34, Quantum CPUs 140CPU65, Premium CPUs TSXP57, M340 ethernet modules BMXNOC0401/BMXNOE01/BMXNOR0200H, and Quantum/Premium factory cast modules 140NOE77111, 140NOC78*00, TSXE...
CVE-2022-22724
A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 HTTP and 502 Modbus, when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 All Versions...
Schneider Electric Modicon M340 资源管理错误漏洞
Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric, France. The vulnerability can be exploited to send a large number of TCP RST or FIN packets to any open TCP port of the PLC, resulting in a denial ...
PT-2022-6599
Name of the Vulnerable Software and Affected Versions Modicon M340 CPUs version all Modicon Quantum CPUs with integrated Ethernet version all Modicon Premium CPUs with integrated Ethernet version all Modicon M340 ethernet modules versions BMXNOC0401, BMXNOE01, BMXNOR0200H Modicon Quantum and...
The vulnerability of the microprogrammed logic controller Schneider Electric Modicon M340, related to insufficient validation of input data, allows a intruder to trigger a service failure.
The vulnerability of the microprogramming software of Schneider Electric’s Modicon M340 relates to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending specially crafted GET requests to port 80...
PT-2021-7529
Name of the Vulnerable Software and Affected Versions Modicon M340 CPUs versions prior to V3.40 Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 H, BMXNOE0110 H, BMXNOC0401, BMXNOR0200H RTU All Versions Modicon Premium Processors with integrated Ethernet Copro: TSXP574634, TSXP575634,...
CVE-2021-22789
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU part numbers BM...
CVE-2021-22792
A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU part numbers BMEP and BMEH, all versions, Modicon M340 CPU par...