CVE-2019-6859

A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers All versions of the following CPUs and Communication Module product references listed in the Security Notifications, which could cause the disclosure of FTP hardcoded credentials when using the Web server of the...

CVE-2020-7488

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258 controllers...

CVE-2020-7488

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258 controllers...

CVE-2020-7487

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers...

CVE-2019-6859

The CVE-2019-6859 entry concerns Modicon Controllers with hardcoded FTP credentials exposed via the controller Web server on unsecure networks (CWE-798). Affected scope includes Modicon Controllers across all CPUs and Communication Module references listed in Security Notifications. Root cause is...

CVE-2019-6859

A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers All versions of the following CPUs and Communication Module product references listed in the Security Notifications, which could cause the disclosure of FTP hardcoded credentials when using the Web server of the...

CVE-2019-6859: Use of Hard-coded Credentials

A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers All versions of the following CPUs and Communication Module product references listed in the Security Notifications, which could cause the disclosure of FTP hardcoded credentials when using the Web server of the...

PT-2020-6298

Name of the Vulnerable Software and Affected Versions Modicon M218, M241, M251, and M258 controllers affected versions not specified Description A Cleartext Transmission of Sensitive Information issue exists, which could leak sensitive information transmitted between the software and the...

Schneider Electric Modicon Controllers (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium Vulnerability: Improper Check for Unusual or Exceptional Conditions 2. UPDATE INFORMATION This updated...

CVE-2019-6857

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium see security notification for specific versions which could cause a Denial of Service of the controller when reading specific memory blocks using...

CVE-2018-7794

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium see security notification for specific versions which could cause a Denial of Service when reading data with invalid index using Modbus TCP...

PT-2019-5202

Name of the Vulnerable Software and Affected Versions Modicon Controllers versions prior to the fixed version Description The issue is related to the presence of hardcoded credentials used for transmitting configuration files to Modicon Controllers equipment. This could allow a remote attacker to...

Modicon controllers Data Compromise Check Failure

The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. Exploiting this vulnerability allows a malicious actor to download updates to the embedded software without any interaction with the software via FTP protocol...

Modicon controllers Data Compromise Check Failure

The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. Exploiting this vulnerability allows a malicious actor to download updates to the embedded software via an FTP server without an active web server, thereby...

Modicon controllers Data Compromise Check Failure

The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. Exploiting this vulnerability allows a malicious actor to download updates to the embedded software from a compromised FTP server, thereby causing service...

Modicon controllers DoS

The vulnerability of Modicon microprogrammed controllers lies in the lack of verification of the version of the embedded software updates. Exploiting this vulnerability allows a malicious actor to download an un-supported version of the embedded software via FTP protocol, thereby causing service...

Modicon controllers FTP Information Disclosure

The vulnerability of Modicon microprogrammed controllers relates to the transmission of confidential information in open text using the FTP protocol. Exploiting this vulnerability can allow a remote attacker to disclose the protected information...

Modicon controllers Data Compromise Check Failure

The vulnerability of Modicon microprogrammed controllers lies in the lack of checks for the integrity of updates to the embedded software. Exploiting this vulnerability allows a malicious actor to download the embedded software update with an empty file via FTP protocol, thereby causing service...

Modicon control devices REST API DoS

The vulnerability of Modicon microprogrammed control devices is related to a data processing error in the REST API. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service interruptions...

Modicon Controllers Modbus Disclosure

The vulnerability of Modicon controller’s microprogrammed software is related to the use of the Modbus service provided by the REST API. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...