PT-2019-3856 · Schneider Electric · Modicon Bmxcra+3

Published 2019-10-08 · Updated 2022-02-03 · CVE-2019-6846

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Modicon M580 (all firmware versions) Modicon M340 (all firmware versions) Modicon BMxCRA (all firmware versions) Modicon 140CRA (all firmware versions)

Description The issue is related to the transmission of sensitive information in plaintext using the FTP protocol, which could allow a remote attacker to disclose protected information.

Recommendations For Modicon M580, consider disabling the FTP protocol until a secure alternative is implemented. For Modicon M340, restrict access to the FTP service to minimize the risk of information disclosure. For Modicon BMxCRA and 140CRA modules, avoid using the FTP protocol for transmitting sensitive information until a patch or secure configuration is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2019-04220

CVE-2019-6846

Affected Products

Modicon 140Cra

Modicon Bmxcra

Modicon M340

Modicon M580

References · 4

• https://schneider-electric.com/ww/en/download/document/SEVD-2019-281-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6846 · Security Note
• https://bdu.fstec.ru/vul/2019-04220 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-281-02 · Note