CVE-2019-6816 Code injection in Modicon Quantum - all firmware versions
Attackers can inject code via Modbus to modify firmware and cause denial of service on Modicon Quantum PLCs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6816?
CVE-2019-6816 is a critical code injection vulnerability in Modicon Quantum - all firmware versions, published on 22 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Service when using Modbus protocol.
Weakness: CWE-94
Which versions are affected by CVE-2019-6816?
It affects 1 product.
Products include Schneider-Electric Modicon Quantum Firmware.
How do I fix CVE-2019-6816?
No fix has been published for CVE-2019-6816 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-6816 being exploited?
There is no known exploitation of CVE-2019-6816 in the wild and no public exploit code.
Other vulnerabilities in Modicon Quantum - all firmware versions
Sources
Also known as GHSA-cc47-9r7p-x4hv.