PT-2018-2169 · Schneider Electric · Bmxnor0200+3

Publicado 2018-11-28 · Atualizado 2018-12-28 · CVE-2018-7810

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (affected versions not specified)

Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on. The vulnerability exists in the embedded web servers of the affected devices, enabling an attacker to inject JavaScript code that will be executed in the user's browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-00122

CVE-2018-7810

Produtos afetados

Bmxnor0200

Modicon M340

Premium

Quantum

Referências · 4

• 🔥 https://tenable.com/security/research/tra-2018-38 · Exploit
• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7810 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-00122 · Nota de Segurança