Vulnerability CVE-2018-7809
Published: 2018-11-30

Description:
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server.

Type:

CWE-640

 (Weak Password Recovery Mechanism for Forgotten Password)

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Schneider-electric -> Modicom bmxnor0200h firmware 
Schneider-electric -> Modicom m340 firmware 
Schneider-electric -> Modicom premium firmware 
Schneider-electric -> Modicom quantum firmware 

 References:
https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/
https://www.tenable.com/security/research/tra-2018-38
Copyright 2024, cxsecurity.com

 

Back to Top