{"schemaVersion":3,"id":"CVE-2018-7809","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server.","dates":{"published":"2018-11-30T19:00:00.000Z","modified":"2024-08-05T06:37:59.446Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.4,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02468,"percentile":0.84264,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.02468},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02141,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02468,"percentile":0.84264}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02141,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02468,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02468,"percentile":0.84264}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_3E2A4748A8BB08D4","name":"Exploit Reference (tenable.com)","source":"reference","url":"https://www.tenable.com/security/research/tra-2018-38","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-640","name":"Weak Password Recovery Mechanism for Forgotten Password","description":"The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/640.html"}],"affected":[{"vendor":"schneider electric se","product":"embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200","name":"Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200","label":"embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200","noFixRecorded":false,"fixedIn":null}],"versionsText":"Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200","eol":null,"hubHref":"/vendor/schneider_electric_se/embedded_web_servers_in_all_modicon_m340_premium_quantum_plcs_and_bmxnor0200"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.tenable.com/security/research/tra-2018-38","label":"www.tenable.com/security/research/tra-2018-38","hostname":"www.tenable.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/","label":"www.schneider-electric.com/en/download/document/SEVD-2018-327-01/","hostname":"www.schneider-electric.com","tags":["X Refsource CONFIRM","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-11-30T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T06:37:59.446Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:37:33.845Z","stale":false,"partial":false}}