IM
IronMonkey Threat Research

CVE-2019-6846 MEDIUM

Published: 2019-10-29 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause information disclosure when using the FTP protocol.

Additional Descriptions (1)

Una CWE-319: Existe una vulnerabilidad de Transmisión de Texto Sin Cifrar de Información Confidencial en Modicon M580, Modicon M340, Modicon BMxCRA y los módulos 140CRA (todas las versiones de firmware), que podrían causar una divulgación de información cuando se utiliza el protocolo FTP.

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-319
[email protected] Primary
en CWE-319

Affected Products

Vendor Product Version Update Type
schneider-electric modicon_m580_firmware * <built-in method update of dict object at 0x7634bc274e40> Operating System
schneider-electric modicon_m340_firmware * <built-in method update of dict object at 0x7634b47c9a80> Operating System
schneider-electric modicon_bmxcra_firmware * <built-in method update of dict object at 0x763487f4c680> Operating System
schneider-electric modicon_140cra_firmware * <built-in method update of dict object at 0x76340b5fa0c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:modicon_m580:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:modicon_m340:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:modicon_bmxcra_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:modicon_bmxcra:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:modicon_140cra_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:modicon_140cra:-:*:*:*:*:*:*:*

References