CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Schneider-electric : Security Vulnerabilities Published In 2019

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-10981 255 2019-05-31 2019-09-30
2.1
None Local Low Not required Partial None None
In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect user credentials.
2 CVE-2019-10953 400 2019-04-17 2019-05-22
5.0
None Remote Low Not required None None Partial
ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets.
3 CVE-2019-6833 754 2019-09-17 2019-10-10
4.3
None Remote Medium Not required None None Partial
A CWE-754 ? Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU), which could cause a temporary freeze of the HMI when a high rate of frames is received. When the attack stops, the buffered commands are processed by the HMI panel.
4 CVE-2019-6831 754 2019-09-17 2019-10-02
5.0
None Remote Low Not required None None Partial
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause disconnection of active connections when an unusually high number of IEC 60870- 5-104 packets are received by the module on port 2404/TCP.
5 CVE-2019-6828 755 DoS 2019-09-17 2019-10-09
7.8
None Remote Low Not required None None Complete
A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Premium (all versions), and Modicon Quantum (all versions), which could cause a possible denial of service when reading specific coils and registers in the controller over Modbus.
6 CVE-2019-6827 787 2019-07-15 2019-07-22
6.8
None Remote Medium Not required Partial Partial Partial
A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System (IGSS), Version 14 and prior, which could cause a software crash when data in the mdb database is manipulated.
7 CVE-2019-6826 426 Exec Code 2019-09-17 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code execution on the system running SoMachine HVAC when a malicious DLL library is loaded by the product.
8 CVE-2019-6825 427 Exec Code 2019-07-15 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow a malicious DLL file, with the same name of any resident DLLs inside the software installation, to execute arbitrary code in all versions of ProClima prior to version 8.0.0.
9 CVE-2019-6824 119 Exec Code Overflow 2019-07-15 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.
10 CVE-2019-6823 94 Exec Code 2019-07-15 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.
11 CVE-2019-6822 416 Exec Code 2019-07-15 2019-07-22
6.8
None Remote Medium Not required Partial Partial Partial
A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.
12 CVE-2019-6821 330 2019-05-22 2019-06-17
5.0
None Remote Low Not required Partial None None
CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum.
13 CVE-2019-6820 306 2019-05-22 2019-10-09
6.4
None Remote Low Not required None Partial Partial
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2
14 CVE-2019-6819 754 DoS 2019-05-22 2019-07-03
5.0
None Remote Low Not required None None Partial
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium.
15 CVE-2019-6816 94 DoS 2019-05-22 2019-05-23
6.4
None Remote Low Not required None Partial Partial
In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Service when using Modbus protocol.
16 CVE-2019-6815 264 DoS 2019-05-22 2019-05-23
6.4
None Remote Low Not required None Partial Partial
In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could cause a denial of service or unauthorized modifications of the PLC configuration when using Ethernet/IP protocol.
17 CVE-2019-6813 754 DoS 2019-09-17 2019-10-02
7.8
None Remote Low Not required None None Complete
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions) and Modicon M340 controller (all firmware versions), which could cause denial of service when truncated SNMP packets on port 161/UDP are received by the device.
18 CVE-2019-6812 798 2019-05-22 2019-09-30
4.0
None Remote Low Single system Partial None None
A CWE-798 use of hardcoded credentials vulnerability exists in BMX-NOR-0200H with firmware versions prior to V1.7 IR 19 which could cause a confidentiality issue when using FTP protocol.
19 CVE-2019-6811 754 DoS 2019-09-17 2019-10-09
5.0
None Remote Low Not required None None Partial
An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cause denial of service when the module receives an IP fragmented packet with a length greater than 65535 bytes. The module then requires a power cycle to recover.
20 CVE-2019-6810 863 Exec Code 2019-09-17 2019-10-02
6.5
None Remote Low Single system Partial Partial Partial
CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of commands by unauthorized users when using IEC 60870-5-104 protocol.
21 CVE-2019-6809 755 DoS 2019-09-17 2019-10-09
7.8
None Remote Low Not required None None Complete
A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior to V3.10), Modicon Premium (all versions), Modicon Quantum (all versions), which could cause a possible denial of service when reading invalid data from the controller.
22 CVE-2019-6808 284 Exec Code 2019-05-22 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus.
23 CVE-2019-6807 754 DoS 2019-05-22 2019-06-10
5.0
None Remote Low Not required None None Partial
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of service when writing sensitive application variables to the controller over Modbus.
24 CVE-2019-6806 200 +Info 2019-05-22 2019-06-10
5.0
None Remote Low Not required Partial None None
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus.
25 CVE-2018-7856 754 DoS 2019-05-22 2019-06-11
5.0
None Remote Low Not required None None Partial
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus.
26 CVE-2018-7855 754 DoS 2019-05-22 2019-06-10
5.0
None Remote Low Not required None None Partial
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus
27 CVE-2018-7854 754 DoS 2019-05-22 2019-06-10
5.0
None Remote Low Not required None None Partial
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service when sending invalid debug parameters to the controller over Modbus.
28 CVE-2018-7853 754 DoS 2019-05-22 2019-06-10
5.0
None Remote Low Not required None None Partial
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus
29 CVE-2018-7852 20 DoS 2019-05-22 2019-06-10
5.0
None Remote Low Not required None None Partial
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus.
30 CVE-2018-7851 119 DoS Overflow 2019-05-22 2019-10-09
6.8
None Remote Low Single system None None Complete
CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware prior to V2.40, All firmware versions of Modicon Premium and 140CRA312xxx when sending a specially crafted Modbus packet, which could cause a denial of service to the device that would force a restart to restore availability.
31 CVE-2018-7850 20 2019-05-22 2019-06-11
5.0
None Remote Low Not required Partial None None
A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software.
32 CVE-2018-7849 20 DoS 2019-05-22 2019-06-10
5.0
None Remote Low Not required None None Partial
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending files the controller over Modbus.
33 CVE-2018-7848 200 +Info 2019-05-22 2019-06-10
5.0
None Remote Low Not required Partial None None
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus
34 CVE-2018-7847 284 DoS Exec Code 2019-05-22 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus.
35 CVE-2018-7846 119 Overflow 2019-05-22 2019-06-10
5.0
None Remote Low Not required Partial None None
A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller.
36 CVE-2018-7845 125 2019-05-22 2019-06-10
5.0
None Remote Low Not required Partial None None
A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus.
37 CVE-2018-7844 200 +Info 2019-05-22 2019-06-10
5.0
None Remote Low Not required Partial None None
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus.
38 CVE-2018-7843 399 DoS 2019-05-22 2019-06-10
5.0
None Remote Low Not required None None Partial
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus.
39 CVE-2018-7842 264 Bypass 2019-05-22 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller.
40 CVE-2018-7841 89 Exec Code Sql 2019-05-22 2019-05-23
7.5
None Remote Low Not required Partial Partial Partial
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
41 CVE-2018-7839 310 2019-02-06 2019-06-07
2.1
None Local Low Not required Partial None None
A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure.
42 CVE-2018-7834 79 XSS 2019-05-22 2019-10-09
4.3
None Remote Medium Not required None Partial None
A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded script to a user that would then be executed within the context of that user.
43 CVE-2018-7824 400 2019-05-22 2019-10-09
6.8
None Remote Low Single system None Complete None
An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files.
44 CVE-2018-7823 20 2019-05-22 2019-05-23
5.0
None Remote Low Not required None None Partial
A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine Basic when sending crafted ethernet message.
45 CVE-2018-7822 275 2019-05-22 2019-05-23
2.1
None Local Low Not required Partial None None
An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause unauthorized access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic.
46 CVE-2018-7821 399 2019-05-22 2019-05-23
5.0
None Remote Low Not required None None Partial
An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated.
47 CVE-2018-7817 416 Exec Code 2019-02-06 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.
48 CVE-2018-7803 20 2019-05-22 2019-05-23
4.3
None Remote Medium Not required None None Partial
A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.2.0, which could cause the emulator to crash when sending a specially crafted packet. The emulator is used infrequently for application logic testing. It is susceptible to an attack only while running in off-line mode. This vulnerability does not exist in Triconex hardware products and therefore has no effect on the operating safety functions in a plant.
49 CVE-2015-6462 79 XSS 2019-03-21 2019-10-09
3.5
None Remote Medium Single system None Partial None
Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser.
50 CVE-2015-6461 20 File Inclusion 2019-03-21 2019-10-09
5.5
None Remote Low Single system Partial Partial None
Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.
Total number of vulnerabilities : 51   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.