Schneider Electric Modicon Premium vulnerabilities
8 vulnerabilities
Known vulnerabilities in Schneider Electric Modicon Premium, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-7857schneider-electricmodicon_m340_firmware+3
EPSS score1.58%
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus.CVE-2018-7855schneider-electricmodicon_m340_firmware+3EPSS score2.65%
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over ModbusCVE-2018-7856schneider-electricmodicon_m340_firmware+3EPSS score1.58%
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus.CVE-2018-7853schneider-electricmodicon_m340_firmware+3EPSS score1.82%
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over ModbusCVE-2013-0664schneider-electricmodicon_m340_firmware+2EPSS score3.91%
The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests.CVE-2013-0663schneider-electricmodicon_m340_firmware+2EPSS score5.96%
Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials.CVE-2019-6806schneider-electricmodicon_m340_firmware+3EPSS score2.30%
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus.CVE-2019-6808schneider-electricmodicon_m340_firmware+3EPSS score8.16%
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus.