CVE-2019-6821
Severity Score
6.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum.
Una CWE-330: Una vulnerabilidad de Uso Insuficientes de valores aleatorios, podría generar el secuestro de la conexión TCP cuando se utiliza el protocolo de comunicación Ethernet en Modicon M580 versiones de firmware anteriores a V2.30, y todas las versiones de firmware de Modicon M340, Modicon Premium, Modicon Quantum.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-01-25 CVE Reserved
- 2019-05-22 CVE Published
- 2024-06-19 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-330: Use of Insufficiently Random Values
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/108366 | Third Party Advisory | |
| https://ics-cert.us-cert.gov/advisories/ICSA-19-136-01 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.schneider-electric.com/en/download/document/SEVD-2019-134-03 | 2022-02-03 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Schneider-electric Search vendor "Schneider-electric" | Modicon M580 Firmware Search vendor "Schneider-electric" for product "Modicon M580 Firmware" | < 2.30 Search vendor "Schneider-electric" for product "Modicon M580 Firmware" and version " < 2.30" | - |
Affected
| in | Schneider-electric Search vendor "Schneider-electric" | Modicon M580 Search vendor "Schneider-electric" for product "Modicon M580" | - | - |
Safe
|
| Schneider-electric Search vendor "Schneider-electric" | Modicon M340 Firmware Search vendor "Schneider-electric" for product "Modicon M340 Firmware" | * | - |
Affected
| in | Schneider-electric Search vendor "Schneider-electric" | Modicon M340 Search vendor "Schneider-electric" for product "Modicon M340" | - | - |
Safe
|
| Schneider-electric Search vendor "Schneider-electric" | Modicon Quantum Firmware Search vendor "Schneider-electric" for product "Modicon Quantum Firmware" | * | - |
Affected
| in | Schneider-electric Search vendor "Schneider-electric" | Modicon Quantum Search vendor "Schneider-electric" for product "Modicon Quantum" | - | - |
Safe
|
| Schneider-electric Search vendor "Schneider-electric" | Modicon Premium Firmware Search vendor "Schneider-electric" for product "Modicon Premium Firmware" | * | - |
Affected
| in | Schneider-electric Search vendor "Schneider-electric" | Modicon Premium Search vendor "Schneider-electric" for product "Modicon Premium" | - | - |
Safe
|