CVE-2018-7811

CVE-2018-7811 affects Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The embedded web servers expose an Unverified Password Change vulnerability that allows an unauthenticated remote attacker to access the change password function. This is a server-side authentication/auth...

CVE-2018-7811

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...

CVE-2018-7831

This entry documents CVE-2018-7831, affecting Schneider Electric Modicon embedded web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The vulnerability is an improper neutralization of script-related HTML tags (Basic XSS) that can be exploited by sending a specially crafted URL to a curren...

CVE-2018-7831

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...

CVE-2018-7830

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for 1 minute by sending a specially crafted HTTP request...

CVE-2018-7810

CVE-2018-7810 is an XSS vulnerability in the embedded web servers of Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is improper neutralization of input during web page generation, allowing an attacker to craft a URL containing JavaScript that will be execute...

CVE-2018-7809

The CVE-2018-7809 issue affects Schneider Electric Modicon embedded Web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is an Unverified Password Change vulnerability that allows an unauthenticated remote attacker to access the password delete function via the web server. Im...

CVE-2018-7809

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server...

CVE-2018-7810

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browse...

Denial of Service Vulnerability in Multiple Schneider Electric Products (CNVD-2018-24634)

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. A denial of service vulnerability exists in the embedded web server in several Schneider Electric products, which can be exploited by an attacker to cause a denial of service by sending ...

Cross-site scripting vulnerability in multiple Schneider Electric products (CNVD-2018-25427)

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. A cross-site scripting vulnerability exists in the embedded web server in several Schneider Electric products, which can be exploited by remote attackers to change passwords on the web...

Cross-site scripting vulnerability in multiple Schneider Electric products (CNVD-2018-25428)

Schneider Electric Modicon M340, etc. are programmable logic controller products of Schneider Electric France. A cross-site scripting vulnerability exists in the embedded web server in several Schneider Electric products, which can be exploited by remote attackers to execute JavaScript code in a...

Modicon Quantum HTTP Server 'formTest' 'name' Parameter XSS

Binary data scadamodiconformtestxss.nbin...

Schneider Electric Modicon M221

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: Modicon M221 Vulnerability: Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a change of...

CVE-2018-7798

A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...

Design/Logic Flaw

A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...

CVE-2018-7798

A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...

CVE-2018-7798

CVE-2018-7798 affects Schneider Electric Modicon M221 PLCs (all versions). Root cause: Insufficient Verification of Data Authenticity (CWE-345) in the UMAS protocol, enabling a remote attacker to modify IPv4 configuration (IP address, subnet mask, gateway). Reported impact: potential remote recon...

CVE-2018-7798

A Insufficient Verification of Data Authenticity CWE-345 vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration IP address, mask and gateway when remotely connected to the device...

The vulnerability of FTP servers of microprogrammed logic controllers from Schneider Electric—Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200—allows attackers to select passwords.

The vulnerability of FTP servers of microprogrammed logic controllers from Schneider Electric, such as Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200, is related to errors in the implementation of cryptographic algorithms. Exploiting this vulnerability can allow an attacker to...