Vulnerability in Schneider-Electric Modicom Bmxnor0200h
CVE-2018-7811
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.035 (88.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.035 · newest: 0.035 · change: 0.000
Affected products
- Schneider-Electric Modicom Bmxnor0200h
- Schneider-Electric Modicom Bmxnor0200h Firmware
- Schneider-Electric Modicom M340
- Schneider-Electric Modicom M340 Firmware
- Schneider-Electric Modicom Premium
- Schneider-Electric Modicom Premium Firmware
- Schneider-Electric Modicom Quantum
- Schneider-Electric Modicom Quantum Firmware
- Schneider Electric Se Embedded Web Servers In All Modicon M340, Premium, Quantum Plcs And Bmxnor0200 — versions Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Weakness classification (CWE)
References
- www.tenable.com/security/research/tra-2018-38 (Exploit, Third Party Advisory)
- www.schneider-electric.com/en/download/document/SEVD-2018-327-01/ (Vendor Advisory)
- security.cse.iitk.ac.in/responsible-disclosure
Frequently asked questions
- What is CVE-2018-7811?
- CVE-2018-7811 is a critical-severity vulnerability in Schneider-Electric Modicom Bmxnor0200h, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 9.8/10. Published 2018-11-30.
- How severe is CVE-2018-7811?
- Critical severity. CVSS v3 base score is 9.8 out of 10.