PT-2012-1184

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon Quantum PLC affected versions not specified Schneider Electric Modicon M340 affected versions not specified Description The issue is related to a lack of authentication between the Unity software and the PLC, which c...

PT-2012-1182

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon Quantum PLC affected versions not specified Schneider Electric Modicon M340 affected versions not specified Description The issue is caused by multiple buffer overflows in the PLC's software, allowing remote attacker...

PT-2012-1183

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon M340 affected versions not specified Schneider Electric Modicon Quantum PLC affected versions not specified Description The issue is related to insufficient input validation in the software of the programmable logic...

Ladder logic

The devices tested by the Basecamp Project included the D20 PLC by GE, The Modicon Quantum by Schneider Electric, Rockwell and Koyo Electronics. Each device was tested using a number of additional attack vectors. Researchers attempted to upload custom firmware or so-called “ladder logic” for the...

Schneider Modicon Quantum Password Recovery

The Schneider Modicon Quantum series of Ethernet cards store usernames and passwords for the system in files that may be retrieved via backdoor access. This module is based on the original 'modiconpass.rb' Basecamp module from DigitalBond. Module Options msf use...

Modicon Quantum TFTP Arbitrary File Upload

Binary data scadamodicontftpenabled.nbin...

CVE-2011-4860

The ComputePassword function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module generates the password for the fwupgrade account by performing a calculation on the MAC address, which makes it easier for remote attackers to obtain access via a ...

CVE-2011-4861

The modbus125handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code to TCP port 502...

CVE-2011-4859

The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771 and 140CPU65 modules, the Premium TSXETY and TSXP57 modules, the M340 BMXNOE01 and BMXP3420 modules, and the STB DIO STBNIC2212 and STBNIP2 modules, uses hardcoded passwords for the 1 AUTCSE, 2 AUTCSE, 3 fdrusers, 4...

Hardcoded credentials

The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771 and 140CPU65 modules, the Premium TSXETY and TSXP57 modules, the M340 BMXNOE01 and BMXP3420 modules, and the STB DIO STBNIC2212 and STBNIP2 modules, uses hardcoded passwords for the 1 AUTCSE, 2 AUTCSE, 3 fdrusers, 4...

Design/Logic Flaw

The ComputePassword function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module generates the password for the fwupgrade account by performing a calculation on the MAC address, which makes it easier for remote attackers to obtain access via a ...

CVE-2011-4859

The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771 and 140CPU65 modules, the Premium TSXETY and TSXP57 modules, the M340 BMXNOE01 and BMXP3420 modules, and the STB DIO STBNIC2212 and STBNIP2 modules, uses hardcoded passwords for the 1 AUTCSE, 2 AUTCSE, 3 fdrusers, 4...

CVE-2011-4860

The ComputePassword function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module generates the password for the fwupgrade account by performing a calculation on the MAC address, which makes it easier for remote attackers to obtain access via a ...

CVE-2011-4861

The modbus125handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code to TCP port 502...

CVE-2011-4859

CVE-2011-4859 concerns the Schneider Electric Quantum Ethernet Module family, where hard-coded credentials exist for 16 accounts (AUTCSE, AUT_CSE, fdrusers, ftpuser, loader, nic2212, nimrohs2212, nip2212, noe77111_v500, ntpupdate, pcfactory, sysdiag, target, test, USER, webserver). This enables r...

CVE-2011-4860

The vulnerability CVE-2011-4860 affects the Schneider Electric Quantum Ethernet Module NOE 771 (aka Quantum 140NOE771*) where the ComputePassword function derives the fwupgrade password from the MAC address. This allows remote attackers to gain access via (1) ARP requests or (2) Neighbor Solicita...

CVE-2011-4861

The CVE-2011-4861 entry concerns Schneider Electric Quantum Ethernet Module (NOE 771 / Quantum 140NOE771*) that allows remote firmware updates via the MODBUS 125 function code sent to TCP port 502 through the modbus_125_handler. This is a software/firmware update mechanism vulnerability in the de...

PT-2011-5150

Name of the Vulnerable Software and Affected Versions Schneider Electric Quantum Ethernet Module on the NOE 771 device affected versions not specified Description The issue allows remote attackers to install arbitrary firmware updates. This is achieved by exploiting the modbus 125 handler functio...

PT-2011-1000

Name of the Vulnerable Software and Affected Versions Schneider Electric Quantum Ethernet Module versions used in the Quantum 140NOE771 and 140CPU65 modules, the Premium TSXETY and TSXP57 modules, the M340 BMXNOE01 and BMXP3420 modules, and the STB DIO STBNIC2212 and STBNIP2 modules Description T...

CVE-2011-4861: Undefined Security Weakness

The modbus125handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code to TCP port 502...