EVlink City < R8 V3.4.0.1 - Authentication Bypass

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution

SpaceLogic C-Bus Home Controller through 1.31.460 is susceptible to remote command execution via improper neutralization of special elements. Remote root exploit can be enabled when the command is compromised, and an attacker can potentially execute malware, obtain sensitive information, modify...

Schneider Electric U.motion Builder - SQL Injection

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter. id: CVE-2018-7765 info: name: Schneider Electric U.motion...

Schneider Electric U.motion Builder - Remote Code Execution

U.motion Builder 1.3.4 contains a remote code execution vulnerability caused by improper input sanitization, allowing attackers to execute arbitrary system commands through crafted input parameters. id: CVE-2018-7841 info: name: Schneider Electric U.motion Builder - Remote Code Execution author:...

apxutil

슈나이더 일렉트릭 PLC 아카이브 파일을 조작하는 도구 이 도구는 슈나이더 일렉트릭의 여러 PLC최소한 M580, M340, Quantum에서 사용되는 PLC "아카이브" 파일을 추출하고 재조립할 수 있습니다. .sta 확장자를 가진 아카이브 파일은 실제로 몇 개의 파일이 포함된 ZIP 아카이브입니다. 아카이브 내에서 진정으로 중요한 파일은 Station.apx라는 이름의 파일입니다. 이 파일의 내용은 전체 프로그램 다운로드/업로드 중 PLC로/로부터 전송되는 내용입니다. 당연히 PLC 프로그램의 실제 실행 코드가 포함되어...

CVE-2018-7848

CVE-2018-7848 영향을 받는 제품 Schneider Electric Modicon M580 버전 2.90 Schneider Electric Modicon M340 버전 3.10 Schneider Electric Modicon Premium 모든 버전 Schneider Electric Modicon Quantum 모든 버전 참고 자료 https://www.se.com/ww/en/download/document/SEVD-2019-134-11/...

CVE-2018-7845

CVE-2018-7845 影響を受ける製品 Schneider Electric Modicon M580 バージョン 2.80 Schneider Electric Modicon M340 バージョン 3.01 Schneider Electric Modicon Premium バージョン 3.20 Schneider Electric Modicon Quantum バージョン 3.60 参照 https://www.se.com/ww/en/download/document/SEVD-2019-134-11/...

CVE-2018-7842

CVE-2018-7842 영향받는 제품 Schneider Electric Modicon M580 버전 2.90 Schneider Electric Modicon M340 버전 3.10 Schneider Electric Modicon Premium 모든 버전 Schneider Electric Modicon Quantum 모든 버전 참고 자료 https://www.se.com/ww/en/download/document/SEVD-2019-134-11/...

CVE-2018-7849

CVE-2018-7849 영향을 받는 제품 Schneider Electric Modicon M580 버전 2.90 Schneider Electric Modicon M340 버전 3.10 Schneider Electric Modicon Premium 모든 버전 Schneider Electric Modicon Quantum 모든 버전 참고 자료 https://www.se.com/ww/en/download/document/SEVD-2019-134-11/...

CVE-2018-7852

CVE-2018-7852 영향을 받는 제품 Schneider Electric Modicon M580 버전 2.80 Schneider Electric Modicon M340 버전 3.01 Schneider Electric Modicon Premium 버전 3.20 Schneider Electric Modicon Quantum 버전 3.60 참조 https://www.se.com/ww/en/download/document/SEVD-2019-134-11/...

CVE-2018-7854

CVE-2018-7854 영향받는 제품 Schneider Electric Modicon M580 버전 2.90 Schneider Electric Modicon M340 버전 3.10 참고 자료 https://www.se.com/ww/en/download/document/SEVD-2019-134-11/ https://www.talosintelligence.com/vulnerabilityreports/TALOS-2019-0765 사용법 root@kitploit: python CVE-2018-7854.py --host...

CVE-2018-7846

CVE-2018-7846 Productos afectados Schneider Electric Modicon M580 Versión 2.90 Schneider Electric Modicon M340 Versión 3.10 Schneider Electric Modicon Premium Todas las versiones Schneider Electric Modicon Quantum Todas las versiones Referencias...

PT-2026-89045

News: Schneider Electric, Siemens, and Aveva ship ICS Patch Tuesday. Worst new hit: Modicon M580 auth CVE-2026-3869 CVSS 9.2. Siemens flags critical Reyrolle 7SR5, OIS, Industrial Edge bugs. OT owners: patch controllers now. https://t.co/TT7I5NW8Ee...

CVE-2026-77120

creationtimestamp| type| source ---|---|--- 2026-09-08 16:45:07+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-schneider-electric-15 2026-09-09 17:28:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/apgqf2kdfuep5...

CVE-2026-3869

creationtimestamp| type| source ---|---|--- 2026-09-08 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-schneider-electric-15 2026-09-09 13:45:25+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mv3oc4sdrp2x 2026-09-11 17:20:09+00:00| seen|...

Schneider Electric EcoStruxure Panel Server Initialization of a Resource with an Insecure Default (CVE-2026-6866)

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials. This plugin only...

Schneider Electric Modicon Controllers M241, M251, M258, and LMC058 Improper Neutralization of Input During Web Page Generation (CVE-2025-13902)

CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause condition where authenticated attackers can have a victim's browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server...

The vulnerability of Schneider Electric’s Cybersecurity Admin Expert (CAE) software, a security management tool, stems from insufficient protection for registration data. This vulnerability allows attackers to enhance their privileges.

The vulnerability of Schneider Electric’s Security Management Software, EcoStruxure Cybersecurity Admin Expert CAE, is related to insufficient protection for registration data. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2026-60889

Name of the Vulnerable Software and Affected Versions Schneider Electric EcoStruxure Cybersecurity Admin Expert affected versions not specified Description Insufficient protection of stored credentials within the application allows a local privileged attacker to bypass authentication and perform...

Schneider Electric Modicon M241, M251, and M262 Improper Resource Shutdown or Release (CVE-2025-13901)

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels. This plugin only works with Tenable.ot. Please visit...