PT-2018-2168 · Schneider Electric · Bmxnor0200+3

Published 2018-11-23 · Updated 2018-12-28 · CVE-2018-7809

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 (affected versions not specified)

Description The issue is related to an Unverified Password Change vulnerability in the embedded web servers. This could allow an unauthenticated remote user to access the password delete function of the web server. The vulnerability is associated with a lack of necessary password verification, which may enable an attacker to exploit it and gain unauthorized access.

Recommendations For Modicon M340, Premium, Quantum PLCs and BMXNOR0200, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-620

CWE-640

Related Identifiers

BDU:2019-00121

CVE-2018-7809

Affected Products

Bmxnor0200

Modicon M340

Premium

Quantum

References · 4

• 🔥 https://tenable.com/security/research/tra-2018-38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7809 · Security Note
• https://bdu.fstec.ru/vul/2019-00121 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2018-327-01 · Vendor Advisory