CVE-2019-6846 MEDIUM

Published: 2019-10-29 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause information disclosure when using the FTP protocol.

Additional Descriptions (1)

Una CWE-319: Existe una vulnerabilidad de Transmisión de Texto Sin Cifrar de Información Confidencial en Modicon M580, Modicon M340, Modicon BMxCRA y los módulos 140CRA (todas las versiones de firmware), que podrían causar una divulgación de información cuando se utiliza el protocolo FTP.

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector	NETWORK
Access Complexity	MEDIUM
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-319
[email protected]	Primary	en CWE-319

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_m580_firmware	*	<built-in method update of dict object at 0x7e60bbd62200>	Operating System
schneider-electric	modicon_m340_firmware	*	<built-in method update of dict object at 0x7e60a8a6ad80>	Operating System
schneider-electric	modicon_bmxcra_firmware	*	<built-in method update of dict object at 0x7e60bbd61b80>	Operating System
schneider-electric	modicon_140cra_firmware	*	<built-in method update of dict object at 0x7e60bbd633c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_bmxcra_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_bmxcra:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_140cra_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_140cra:-:::::::*`

References

https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02
Source: [email protected]

Vendor Advisory
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory