PT-2019-5202 · Schneider Electric · Modicon Controllers
Published
2019-12-12
·
Updated
2022-02-03
·
CVE-2019-6859
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Modicon Controllers versions prior to the fixed version
Description
The issue is related to the presence of hardcoded credentials used for transmitting configuration files to Modicon Controllers equipment. This could allow a remote attacker to execute arbitrary commands on the equipment. The vulnerability may cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
Recommendations
For Modicon Controllers versions prior to the fixed version, consider disabling the use of hardcoded credentials for FTP transmissions until a patch is available. Restrict access to the Web server of the controller when it is used on an unsecure network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Using Hardcoded Credentials
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Modicon Controllers