CVE-2019-6855: schneider-electric ecostruxure_control_expert Incorrect Authorization

Vulnerability summary

CVE-2019-6855 is a high (CVSS 7.5) Incorrect Authorization vulnerability in schneider-electric ecostruxure_control_expert. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.7% of scored vulnerabilities.

Timeline

1. 06-01-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.