CVE-2019-6852 Hardcoded credentials in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
Attackers can obtain hardcoded FTP credentials via the web server, enabling unauthorized access to Schneider Modicon controllers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6852?
CVE-2019-6852 is a high-severity vulnerability in Schneider Electric Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), published on 20 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
Weakness: CWE-200
Which versions are affected by CVE-2019-6852?
It affects 10 products.
Products include Schneider-Electric 140 Cpu6x Firmware, Schneider-Electric 140 Noc 77101 Firmware, Schneider-Electric 140 Noc 78x00 Firmware, Schneider-Electric 140 Noe 771x1 Firmware, Schneider-Electric Bmx Noc 0401 Firmware, Schneider-Electric Bmx Noe 0100 Firmware and 4 more.
How do I fix CVE-2019-6852?
No fix has been published for CVE-2019-6852 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-6852 being exploited?
There is no known exploitation of CVE-2019-6852 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
Sources
Also known as GHSA-vhvr-vv9x-qw7q.