CVEvulnerability

CVE-2015-6461

5.4 MEDIUM Published 2019-03-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-03-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
Weaknesses
CWE-20, CWE-98

Description

Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.

Affected configurations

• schneider-electric bmxnoc0401 firmware • schneider-electric bmxnoe0100 firmware • schneider-electric bmxnoe0110 firmware • schneider-electric bmxnoe0110h firmware • schneider-electric bmxnor0200h firmware • schneider-electric modicon m340 bmxp342020 firmware • schneider-electric modicon m340 bmxp342020h firmware • schneider-electric modicon m340 bmxp342030 firmware • schneider-electric modicon m340 bmxp3420302 firmware • schneider-electric modicon m340 bmxp3420302h firmware • schneider-electric modicon m340 bmxp342030h firmware

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program weakness

References