CVSS: 5.5EPSS: 0%CPEs: 22EXPL: 0CVE-2015-6461
https://notcve.org/view.php?id=CVE-2015-6461
21 Mar 2019 — Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page. La inclusión de archivos remotos permite que un atacante manipule una URL específica que referencia al servidor web PLC de Mo... • https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 • CWE-20: Improper Input Validation CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 9.8EPSS: 0%CPEs: 120EXPL: 0CVE-2018-7242
https://notcve.org/view.php?id=CVE-2018-7242
18 Apr 2018 — Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks. Existen algoritmos de hash vulnerables en los controladores Modicon Premium, Modicon Quantum, Modicon M340 y BMXNOR0200, de Schneider Electric, en todas las versiones de los módulos de comunicación. El algoritmo empleado para cifrar la contraseña es... • http://www.securityfocus.com/bid/103543 • CWE-326: Inadequate Encryption Strength •
CVSS: 9.8EPSS: 0%CPEs: 120EXPL: 0CVE-2018-7761
https://notcve.org/view.php?id=CVE-2018-7761
18 Apr 2018 — A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow arbitrary code execution. Existe una vulnerabilidad en Modicon M340, Modicon Premium, Modicon Quantum PLC y BMXNOR0200, de Schneider Electric, que podría permitir la ejecución de código arbitrario. • https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 120EXPL: 0CVE-2018-7762
https://notcve.org/view.php?id=CVE-2018-7762
18 Apr 2018 — A vulnerability exists in the web services to process SOAP requests in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow result in a buffer overflow. Existe una vulnerabilidad en los servicios web que procesan peticiones SOAP en Modicon M340, Modicon Premium, Modicon Quantum PLC y BMXNOR0200, de Schneider Electric, que podría conducir a un desbordamiento de búfer. • https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 120EXPL: 0CVE-2018-7759
https://notcve.org/view.php?id=CVE-2018-7759
18 Apr 2018 — A buffer overflow vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. The buffer overflow vulnerability is caused by the length of the source string specified (instead of the buffer size) as the number of bytes to be copied. Existe una vulnerabilidad de desbordamiento de búfer en Modicon M340, Modicon Premium, Modicon Quantum PLC y BMXNOR0200, de Schneider Electric. La vulnerabilidad de desbordamiento de búfer se provoca por el tamaño de la cadena de ... • https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 120EXPL: 0CVE-2018-7760
https://notcve.org/view.php?id=CVE-2018-7760
18 Apr 2018 — An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions allow malicious users to bypass authorization. Existe una vulnerabilidad de omisión de autenticación en Modicon M340, Modicon Premium, Modicon Quantum PLC y BMXNOR0200, de Schneider Electric. Las peticiones a funciones CGI permiten que usuarios maliciosos omitan la autorización. • https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 0%CPEs: 120EXPL: 0CVE-2018-7241
https://notcve.org/view.php?id=CVE-2018-7241
18 Apr 2018 — Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. Existen cuentas embebidas en los controladores Modicon Premium, Modicon Quantum, Modicon M340 y BMXNOR0200, de Schneider Electric, en todas las versiones de los módulos de comunicación. • http://www.securityfocus.com/bid/103542 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.8EPSS: 6%CPEs: 30EXPL: 0CVE-2017-6017
https://notcve.org/view.php?id=CVE-2017-6017
30 Jun 2017 — A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMXP342000, BMXP3420102, BMXP3420102CL, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H. A remote attacker could send a specially crafted set of packets to the PLC causing it to freeze, requiring the operator to physically press the reset button on the PLC in order to recover. Se ha descubierto un problema de agotamiento d... • http://www.securityfocus.com/bid/96414 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 5%CPEs: 146EXPL: 0CVE-2014-0754
https://notcve.org/view.php?id=CVE-2014-0754
03 Oct 2014 — Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request. Vulnerabil... • http://download.schneider-electric.com/files?p_Reference=SEVD-2014-260-01&p_EnDocType=Software%20-%20Updates&p_File_Id=608959359&p_File_Name=SEVD-2014-260-01.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •