Schneider Electric Web Server on Modicon M340 Out-of-Bounds Write (CVE-2020-7563)

A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules see notification for details which could cause corruption of data, a crash, or code execution when uploading a specially crafted...

Schneider Electric Quantum Ethernet Module Improper Authentication (CVE-2011-4860)

The ComputePassword function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module generates the password for the fwupgrade account by performing a calculation on the MAC address, which makes it easier for remote attackers to obtain access via a ...

Schneider Electric Modicon Credentials Management Errors (CVE-2018-7788)

A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when using a Telnet connection. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Schneider Electric Modicon Improper Check for Unusual or Exceptional Conditions (CVE-2020-7542)

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium see security notifications for affected versions, that could cause denial of service when a specially crafted Read Physical Memo...

Schneider Electric Quantum Ethernet Module Hard-Coded Credentials (CVE-2011-4859)

The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771 and 140CPU65 modules, the Premium TSXETY and TSXP57 modules, the M340 BMXNOE01 and BMXP3420 modules, and the STB DIO STBNIC2212 and STBNIP2 modules, uses hardcoded passwords for the 1 AUTCSE, 2 AUTCSE, 3 fdrusers, 4...

Schneider Electric Modicon Controllers Out-of-Bounds Read (CVE-2018-7845)

A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus. This plugin only...

Schneider Electric Modicon Improper Authentication (CVE-2012-0931)

Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

CVE-2020-7534

A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 All Versions, Modicon Quantum CPUs with...

Cross site request forgery (csrf)

A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 All Versions, Modicon Quantum CPUs with...

CVE-2020-7534

A CWE-352: Cross-Site Request Forgery CSRF vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 All Versions, Modicon Quantum CPUs with...

CVE-2020-7534

CVE-2020-7534 is a CSRF vulnerability affecting Schneider Electric Modicon web servers. Affected products include M340 BMXP34, Quantum CPUs 140CPU65, Premium CPUs TSXP57, M340 ethernet modules BMXNOC0401/BMXNOE01/BMXNOR0200H, and Quantum/Premium factory cast modules 140NOE77111, 140NOC78*00, TSXE...

Interview with the Head of the NSA’s Research Directorate

MIT Technology Review published an interview with Gil Herrera, the new head of the NSAs Research Directorate. Theres a lot of talk about quantum computing, monitoring 5G networks, and the problems of big data: The math department, often in conjunction with the computer science department, helps...

PT-2022-6599

Name of the Vulnerable Software and Affected Versions Modicon M340 CPUs version all Modicon Quantum CPUs with integrated Ethernet version all Modicon Premium CPUs with integrated Ethernet version all Modicon M340 ethernet modules versions BMXNOC0401, BMXNOE01, BMXNOR0200H Modicon Quantum and...

How Quantum Computers Can Impact Security

While it might be too early to completely overhaul security protocols to prepare for quantum computing — not to mention that there is currently no post-quantum cryptographic standard existing at the moment — it would be a good idea for organizations to start planning for the future...

How Quantum Computers Can Impact Security

While it might be too early to completely overhaul security protocols to prepare for quantum computing — not to mention that there is currently no post-quantum cryptographic standard existing at the moment — it would be a good idea for organizations to start planning for the future...

PT-2021-7528 · Schneider Electric · Modicon M340 X80 Ethernet Communication Modules +5

Name of the Vulnerable Software and Affected Versions: Modicon M340 CPUs versions prior to V3.40 Modicon M340 X80 Ethernet Communication Modules versions all versions Modicon Premium Processors with integrated Ethernet versions all versions Modicon Quantum Processors with Integrated Ethernet...

PT-2021-7529

Name of the Vulnerable Software and Affected Versions Modicon M340 CPUs versions prior to V3.40 Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 H, BMXNOE0110 H, BMXNOC0401, BMXNOR0200H RTU All Versions Modicon Premium Processors with integrated Ethernet Copro: TSXP574634, TSXP575634,...

CVE-2021-22789

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU part numbers BM...

CVE-2021-22792

A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU part numbers BMEP and BMEH, all versions, Modicon M340 CPU par...

CVE-2021-22790

A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU part numbers BMEP and BMEH, all versions, Modicon M340 CPU part...