PT-2019-5202 · Schneider Electric · Modicon Controllers
Publicado
2019-12-12
·
Atualizado
2022-02-03
·
CVE-2019-6859
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Modicon Controllers versions prior to the fixed version
Description
The issue is related to the presence of hardcoded credentials used for transmitting configuration files to Modicon Controllers equipment. This could allow a remote attacker to execute arbitrary commands on the equipment. The vulnerability may cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
Recommendations
For Modicon Controllers versions prior to the fixed version, consider disabling the use of hardcoded credentials for FTP transmissions until a patch is available. Restrict access to the Web server of the controller when it is used on an unsecure network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Using Hardcoded Credentials
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Modicon Controllers