Schneider Electric Modicon Improper Check for Unusual or Exceptional Conditions (CVE-2023-25620)

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when a malicious project file is loaded onto the controller by an authenticated user. This plugin only works with Tenable.ot. Please visit...

Schneider Electric Modicon Improper Check for Unusual or Exceptional Conditions (CVE-2023-25619)

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when communicating over the Modbus TCP protocol. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Schneider Electric Modicon M580 代码问题漏洞

The Schneider Electric Modicon M580 is a programmable automation controller from Schneider Electric, France. A code issue vulnerability exists in the Schneider Electric Modicon M580 prior to version 4.10, Modicon M340 CPU prior to version 3.51, which can be exploited by an attacker to cause a...

Vulnerabilities fixed in Schneider Electric Modicon components

Schneider Electric has fixed vulnerabilities in several Modicon components. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or to manipulate the operation of the vulnerable components. To do this, however, the malicious party must have access to the production...

PT-2023-2957 · Schneider Electric · Modicon

Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon affected versions not specified Description: A vulnerability exists due to improper check for unusual or exceptional conditions, which could cause denial of service of the controller when communicating over the Modb...

PT-2023-2956 · Schneider Electric · Schneider Electric Modicon

Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon affected versions not specified Description: A vulnerability exists due to improper check for unusual or exceptional conditions, which could cause denial of service of the controller when a malicious project file is...

Schneider Electric EcoStruxure Products, Modicon PLCs, and Programmable Automation Controllers Improper Check For Unusual or Exceptional Conditions (CVE-2022-45788)

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert All...

Schneider Electric EcoStruxure Control Expert, Process Expert, Modicon M340, M580 and M580 CPU Authentication Bypass By Capture-Replay (CVE-2022-45789)

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert All Versions, EcoStruxure Process Expert Versions pri...

Schneider Electric Modicon M221 Improper Check For Unusual or Exceptional Conditions (CVE-2018-7789)

An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to remotely reboot Modicon M221 using crafted programing protocol frames...

Schneider Electric Modicon Cleartext Transmission of Sensitive Information (CVE-2020-7488)

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258 controllers. This plugin only works with Tenable.ot. Please visit...

Wago PLC Cycle Time Influences Uncontrolled Resource Consumption (CVE-2019-10953)

ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets. This plugin only works with Tenable.ot. Please visit...

Schneider Electric Modicon Missing Authentication for Critical Function (CVE-2019-6820)

A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration IP address, network mask and gateway IP address when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC...

Schneider Electric Modicon X80 Exposure of Sensitive Information to an Unauthorized Actor (CVE-2021-22749)

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could cause information leak concerning the current RTU configuration including communication parameters dedicated to telemetry, when a specially...

Schneider Electric Modicon M221 Information Management Errors (CVE-2018-7790)

An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a...

Schneider Electric Modicon Improper Input Validation (CVE-2021-22699)

Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specific crafted requests are sent to the controller over HTTP. This plugin only works with Tenable.ot. Please visit...

Schneider Electric Modicon M221 Programmable Logic Controller Exposure of Sensitive Information to an Unauthorized Actor (CVE-2020-7568)

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 all references, all versions that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221...

Schneider Electric Modicon PLCs Use of Insufficiently Random Values (CVE-2017-6026)

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization an...

Schneider Electric Modicon M221 Permissions, Privileges, and Access Controls (CVE-2018-7792)

A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product all references, all versions prior to firmware V1.6.2.0. The vulnerability allows unauthorized users to decode the password using rainbow table. This plugin only works with Tenable.ot...

Schneider Electric Modicon M258 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2020-28220)

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware All versions prior to V5.0.4.11 and SoMachine/SoMachine Motion software All versions, that could cause a buffer overflow when the length of a file transferred to the...

Schneider Electric Modicon M221 Programmable Logic Controller Inadequate Encryption Strength (CVE-2020-7565)

A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 all references, all versions that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. This plugin on...