CVE-2018-7809 An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the....
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric modicom m340 firmware | All versions | No fix listed |
| schneider-electric modicom premium firmware | All versions | No fix listed |
| schneider-electric modicom quantum firmware | All versions | No fix listed |
| schneider-electric modicom bmxnor0200h firmware | All versions | No fix listed |
| Schneider Electric SE Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 | = Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 | No fix listed |
References
- www.schneider-electric.com vendor-advisory
- www.tenable.com exploit third-party-advisory