PT-2018-2168 · Schneider Electric · Bmxnor0200+3

Publicado 2018-11-23 · Atualizado 2018-12-28 · CVE-2018-7809

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (affected versions not specified)

Description The issue is related to an Unverified Password Change vulnerability in the embedded web servers. This could allow an unauthenticated remote user to access the password delete function of the web server. The vulnerability is associated with a lack of necessary password verification, which may enable an attacker to exploit it and gain unauthorized access.

Recommendations For Modicon M340, Premium, Quantum PLCs and BMXNOR0200, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-620

CWE-640

Identificadores relacionados

BDU:2019-00121

CVE-2018-7809

Produtos afetados

Bmxnor0200

Modicon M340

Premium

Quantum

Referências · 4

• 🔥 https://tenable.com/security/research/tra-2018-38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7809 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-00121 · Nota de Segurança
• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Aviso do Fabricante