PT-2013-1300 · Schneider Electric · Schneider Electric Quantum+2
T4Rkd3Vilz
·
Published
2013-04-04
·
Updated
2018-05-24
·
CVE-2013-0663
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Schneider Electric Quantum versions 140NOE77111, 140NOE77101, and 140NWM10000
Schneider Electric M340 versions BMXNOC0401, BMXNOE0100x, and BMXNOE011xx
Schneider Electric Premium versions TSXETY4103, TSXETY5103, and TSXWMY100
Description
A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands. This can be achieved by modifying HTTP credentials. The vulnerability can also be exploited by an attacker to launch a script in the context of the current user's security using a specially crafted website.
Recommendations
For Schneider Electric Quantum versions 140NOE77111, 140NOE77101, and 140NWM10000, update the firmware to prevent CSRF attacks.
For Schneider Electric M340 versions BMXNOC0401, BMXNOE0100x, and BMXNOE011xx, restrict access to the web interface until a patch is available.
For Schneider Electric Premium versions TSXETY4103, TSXETY5103, and TSXWMY100, consider disabling the web server functionality as a temporary workaround until a fix is provided.
As a general mitigation measure, restrict access to the vulnerable PLC modules to minimize the risk of exploitation.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Schneider Electric M340
Schneider Electric Premium
Schneider Electric Quantum