CVSS: 10.0EPSS: 0%CPEs: 146EXPL: 0CVE-2014-0754
https://notcve.org/view.php?id=CVE-2014-0754
Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request. Vulnerabilidad de salto de directorio en SchneiderWEB en los módulos Schneider Electric Modicon PLC Ethernet 140CPU65x Exec anterior a 5.5, 140NOC78x Exec anterior a 1.62, 140NOE77x Exec anterior a 6.2, BMXNOC0401 anterior a 2.05, BMXNOE0100 anterior a 2.9, BMXNOE0110x Exec anterior a 6.0, TSXETC101 Exec anterior a 2.04, TSXETY4103x Exec anterior a 5.7, TSXETY5103x Exec anterior a 5.9, TSXP57x ETYPort Exec anterior a 5.7, y TSXP57x Ethernet Copro Exec anterior a 5.5 permite a atacantes remotos visitar recursos arbitrarios a través de una solicitud HTTP manipulada. • http://download.schneider-electric.com/files?p_Reference=SEVD-2014-260-01&p_EnDocType=Software%20-%20Updates&p_File_Id=608959359&p_File_Name=SEVD-2014-260-01.pdf http://www.securityfocus.com/bid/70193 https://ics-cert.us-cert.gov/advisories/ICSA-14-273-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 4%CPEs: 22EXPL: 0CVE-2011-4859
https://notcve.org/view.php?id=CVE-2011-4859
The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771* and 140CPU65* modules, the Premium TSXETY* and TSXP57* modules, the M340 BMXNOE01* and BMXP3420* modules, and the STB DIO STBNIC2212 and STBNIP2* modules, uses hardcoded passwords for the (1) AUTCSE, (2) AUT_CSE, (3) fdrusers, (4) ftpuser, (5) loader, (6) nic2212, (7) nimrohs2212, (8) nip2212, (9) noe77111_v500, (10) ntpupdate, (11) pcfactory, (12) sysdiag, (13) target, (14) test, (15) USER, and (16) webserver accounts, which makes it easier for remote attackers to obtain access via the (a) TELNET, (b) Windriver Debug, or (c) FTP port. El módulo Schneider Electric Quantum Ethernet, tal como se utiliza en los módulos Quantum 140NOE771* y 140CPU65*, los módulos Premium TSXETY* y TSXP57*, los módulos M340 BMXNOE01* y BMXP3420*, y los módulos STB DIO STBNIC2212 y STBNIP2*, utiliza contraseñas estáticas para las cuentas (1) AUTCSE, (2) AUT_CSE, (3) fdrusers, (4) ftpuser, (5) loader, (6) nic2212, (7) nimrohs2212, (8) nip2212, (9) noe77111_v500, (10) ntpupdate, (11) pcfactory, (12) sysdiag, (13) target, (14) test, (15) USER, y (16) webserver, lo que facilita a atacantes remotos obtener acceso a través de (a) TELNET, (b) Windriver Debug, o (c) el puerto FTP. • http://reversemode.com/index.php?option=com_content&task=view&id=80&Itemid=1 http://secunia.com/advisories/47723 http://www.securityfocus.com/bid/51605 http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-346-01.pdf http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf http://www.us-cert.gov/control_systems/pdf/ICSA-12-018-01.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/72587 •