CVE-2019-6850 HIGH

Published: 2019-10-29 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when reading specific registers with the REST API of the controller/communication module.

Additional Descriptions (1)

Una CWE-200: Existe una vulnerabilidad de Exposición de Información en Modicon M580, Modicon BMENOC 0311 y Modicon BMENOC 0321, lo que podría causar la divulgación de información confidencial cuando se leen registros específicos con la API REST del módulo controlador y de comunicación.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-200
[email protected]	Primary	en CWE-200

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_m580_firmware	-	<built-in method update of dict object at 0x7e60ba25f8c0>	Operating System
schneider-electric	modicon_bmenoc_0311_firmware	-	<built-in method update of dict object at 0x7e60a88ac180>	Operating System
schneider-electric	modicon_bmenoc_0321_firmware	-	<built-in method update of dict object at 0x7e60a88ae480>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m580_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m580:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_bmenoc_0311_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_bmenoc_0311:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_bmenoc_0321_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_bmenoc_0321:-:::::::*`

References

https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04
Source: [email protected]

Vendor Advisory
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory