CVE-2015-6485 Information disclosure in n/a
Remote attackers can read sensitive information from device memory by exploiting a padding field in Ethernet packets on Schneider Electric RTUs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-6485?
CVE-2015-6485 is a medium-severity vulnerability in n/a, published on 12 Mar 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Schneider Electric Telvent Sage 2300 RTUs with firmware before C3413-500-S01, and LANDAC II-2, Sage 1410, Sage 1430, Sage 1450, Sage 2400, and Sage 3030M RTUs with firmware before C3414-500-S02J2, allow remote attackers to obtain sensitive information from device memory by reading a padding field of an Ethernet packet.
Weakness: CWE-200
Which versions are affected by CVE-2015-6485?
It affects 1 product.
Products include Schneider-Electric Telvent Rtu Firmware.
How do I fix CVE-2015-6485?
No fix has been published for CVE-2015-6485 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-6485 being exploited?
There is no known exploitation of CVE-2015-6485 in the wild and no public exploit code.
Sources
Also known as GHSA-7qxm-j3q6-829g.