CVE-2013-0663: schneider-electric modicon_m340_firmware Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2013-0663 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in schneider-electric modicon_m340_firmware. EPSS estimates a 5.96% chance of exploitation in the next 30 days, higher than 93.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-04-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.