CVEvulnerability
CVE-2018-7811
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-11-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-640
Description
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server
Affected configurations
• schneider-electric modicom m340 firmware
• schneider-electric modicom premium firmware
• schneider-electric modicom quantum firmware
• schneider-electric modicom bmxnor0200h firmware
Related
Weakness · CWE (1)
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness
References
- https://security.cse.iitk.ac.in/responsible-disclosure security.cse.iitk.ac.in
- https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/ Vendor Advisory
- https://www.tenable.com/security/research/tra-2018-38 Exploit, Third Party Advisory
- https://security.cse.iitk.ac.in/responsible-disclosure security.cse.iitk.ac.in
- https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/ Vendor Advisory
- https://www.tenable.com/security/research/tra-2018-38 Exploit, Third Party Advisory