Vulnerability in Schneider-Electric Modicom Bmxnor0200h
CVE-2018-7809
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.025 (83.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 83.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: 0.000
Affected products
- Schneider-Electric Modicom Bmxnor0200h
- Schneider-Electric Modicom Bmxnor0200h Firmware
- Schneider-Electric Modicom M340
- Schneider-Electric Modicom M340 Firmware
- Schneider-Electric Modicom Premium
- Schneider-Electric Modicom Premium Firmware
- Schneider-Electric Modicom Quantum
- Schneider-Electric Modicom Quantum Firmware
- Schneider Electric Se Embedded Web Servers In All Modicon M340, Premium, Quantum Plcs And Bmxnor0200 — versions Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Weakness classification (CWE)
References
- www.tenable.com/security/research/tra-2018-38 (Exploit, Third Party Advisory)
- www.schneider-electric.com/en/download/document/SEVD-2018-327-01/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2018-7809?
- CVE-2018-7809 is a critical-severity vulnerability in Schneider-Electric Modicom Bmxnor0200h, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 9.8/10. Published 2018-11-30.
- How severe is CVE-2018-7809?
- Critical severity. CVSS v3 base score is 9.8 out of 10.