CVE-2015-7937 Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basi...
HighCVSS 10.0
EPSS 7.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric bmxnoc0401 | All versions | No fix listed |
| schneider-electric bmxnoe0100 | All versions | No fix listed |
| schneider-electric bmxnoe0100h | All versions | No fix listed |
| schneider-electric bmxnoe0110 | All versions | No fix listed |
| schneider-electric bmxnoe0110h | All versions | No fix listed |
| schneider-electric bmxnor0200 | All versions | No fix listed |
| schneider-electric bmxnor0200h | All versions | No fix listed |
| schneider-electric bmxpra0100 | All versions | No fix listed |
| schneider-electric modicon m340 bmxp342020 | All versions | No fix listed |
| schneider-electric modicon m340 bmxp342020h | All versions | No fix listed |
| schneider-electric modicon m340 bmxp342030 | All versions | No fix listed |
| schneider-electric modicon m340 bmxp3420302 | All versions | No fix listed |
| schneider-electric modicon m340 bmxp3420302h | All versions | No fix listed |
References
- download.schneider-electric.com vendor-advisory
- 79622 vdb-entry
- ics-cert.us-cert.gov third-party-advisory us-government-resource