PT-2019-3856 · Schneider Electric · Modicon Bmxcra+3

Publicado 2019-10-08 · Atualizado 2022-02-03 · CVE-2019-6846

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Modicon M580 (all firmware versions) Modicon M340 (all firmware versions) Modicon BMxCRA (all firmware versions) Modicon 140CRA (all firmware versions)

Description The issue is related to the transmission of sensitive information in plaintext using the FTP protocol, which could allow a remote attacker to disclose protected information.

Recommendations For Modicon M580, consider disabling the FTP protocol until a secure alternative is implemented. For Modicon M340, restrict access to the FTP service to minimize the risk of information disclosure. For Modicon BMxCRA and 140CRA modules, avoid using the FTP protocol for transmitting sensitive information until a patch or secure configuration is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

BDU:2019-04220

CVE-2019-6846

Produtos afetados

Modicon 140Cra

Modicon Bmxcra

Modicon M340

Modicon M580

Referências · 4

• https://schneider-electric.com/en/download/document/SEVD-2019-281-02 · Nota
• https://schneider-electric.com/ww/en/download/document/SEVD-2019-281-02 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6846 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-04220 · Nota de Segurança