CVEvulnerability
CVE-2015-7937
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-12-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-119
Description
Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Affected configurations
• schneider-electric bmxnoc0401
• schneider-electric bmxnoe0100
• schneider-electric bmxnoe0100h
• schneider-electric bmxnoe0110
• schneider-electric bmxnoe0110h
• schneider-electric bmxnor0200
• schneider-electric bmxnor0200h
• schneider-electric bmxpra0100
• schneider-electric modicon m340 bmxp342020
• schneider-electric modicon m340 bmxp342020h
• schneider-electric modicon m340 bmxp342030
• schneider-electric modicon m340 bmxp3420302
• schneider-electric modicon m340 bmxp3420302h
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-344-01 Vendor Advisory
- http://www.securityfocus.com/bid/79622 www.securityfocus.com
- https://ics-cert.us-cert.gov/advisories/ICSA-15-351-01 Third Party Advisory, US Government Resource
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-344-01 Vendor Advisory
- http://www.securityfocus.com/bid/79622 www.securityfocus.com
- https://ics-cert.us-cert.gov/advisories/ICSA-15-351-01 Third Party Advisory, US Government Resource