Schneider Electric Se
118 CVEs across 50 Schneider Electric Se products. Browse Schneider Electric Se vulnerabilities, severities, and proof-of-concept exploits.
Schneider Electric Se products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-6857 | High | 7.5 | 2020-01-06 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see secur… |
CVE-2019-6856 | High | 7.5 | 2020-01-06 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see secur… |
CVE-2018-7794 | High | 7.5 | 2020-01-06 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see secur… |
CVE-2019-6840 | Critical | 9.8 | 2019-09-17 | A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U… |
CVE-2019-6835 | Medium | 5.4 | 2019-09-17 | A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG62… |
CVE-2019-6833 | Medium | 6.5 | 2019-09-17 | A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, H… |
CVE-2019-6832 | High | 8.3 | 2019-09-17 | A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLY… |
CVE-2019-6831 | High | 8.6 | 2019-09-17 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which… |
CVE-2019-6830 | Medium | 5.9 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of service when sending an… |
CVE-2019-6829 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prior to V3.10), which… |
CVE-2019-6828 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Prem… |
CVE-2019-6826 | High | 7.8 | 2019-09-17 | A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code execution on the system r… |
CVE-2019-6811 | High | 7.5 | 2019-09-17 | An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cau… |
CVE-2019-6810 | High | 8.8 | 2019-09-17 | CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of c… |
CVE-2019-6809 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior to V3.10), Modicon… |
CVE-2018-7820 | Critical | 9.8 | 2019-09-17 | A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to b… |
CVE-2018-7839 | Medium | 5.5 | 2019-02-06 | A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure. |
CVE-2018-7817 | High | 7.8 | 2019-02-06 | A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafte… |
CVE-2018-7815 | High | 7.8 | 2019-02-06 | A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could cause remote code t… |
CVE-2018-7814 | High | 7.8 | 2019-02-06 | A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could cause remote code to… |
CVE-2018-7813 | High | 7.8 | 2019-02-06 | A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could cause remote code to… |
CVE-2018-7837 | High | 7.5 | 2018-12-24 | An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow… |
CVE-2018-7836 | Critical | 9.8 | 2018-12-24 | An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and exe… |
CVE-2018-7835 | High | 7.5 | 2018-12-24 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files… |
CVE-2018-7832 | High | 8.8 | 2018-12-24 | An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution arbitrary executable when G… |
CVE-2018-7802 | High | 8.8 | 2018-12-24 | A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges. |
CVE-2018-7801 | High | 8.8 | 2018-12-24 | A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code executi… |
CVE-2018-7800 | Critical | 9.8 | 2018-12-24 | A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device. |
CVE-2018-7796 | Medium | 6.3 | 2018-12-24 | A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an overflow in the memcpy function, leading… |
CVE-2018-7793 | High | 8.7 | 2018-12-24 | A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core Servi… |
CVE-2018-7833 | High | 7.5 | 2018-12-17 | An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0… |
CVE-2018-7812 | High | 7.5 | 2018-12-17 | An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where th… |
CVE-2018-7804 | Medium | 6.1 | 2018-12-17 | A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user cli… |
CVE-2018-7797 | Medium | 6.1 | 2018-12-17 | A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all… |
CVE-2018-7831 | High | 8.8 | 2018-11-30 | An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium… |
CVE-2018-7830 | High | 7.5 | 2018-11-30 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in all Modicon M340, Pre… |
CVE-2018-7811 | Critical | 9.8 | 2018-11-30 | An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an u… |
CVE-2018-7810 | Medium | 6.1 | 2018-11-30 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, P… |
CVE-2018-7809 | Critical | 9.8 | 2018-11-30 | An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an u… |
CVE-2018-7807 | High | 8.8 | 2018-11-30 | Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file… |
CVE-2018-7806 | High | 8.8 | 2018-11-30 | Data Center Operation allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly upload… |
CVE-2018-7799 | High | 7.8 | 2018-11-02 | A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbit… |
CVE-2018-7798 | High | 8.2 | 2018-11-02 | A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configura… |
CVE-2018-7792 | High | 7.5 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2018-7791 | Critical | 9.8 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2018-7790 | Critical | 9.8 | 2018-08-29 | An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). Th… |
CVE-2018-7795 | Medium | 5.4 | 2018-08-29 | A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the prod… |
CVE-2018-7789 | High | 7.5 | 2018-08-29 | An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior t… |
CVE-2018-7787 | Medium | 5.3 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTT… |
CVE-2018-7786 | Medium | 6.1 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allow injection of mali… |
CVE-2018-7785 | Critical | 9.8 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass. |
CVE-2018-7784 | Critical | 9.8 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is evaluated as a comm… |
CVE-2018-7783 | High | 7.5 | 2018-07-03 | Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulti… |
CVE-2018-7782 | High | 8.8 | 2018-07-03 | In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear… |
CVE-2018-7781 | High | 8.8 | 2018-07-03 | In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authen… |
CVE-2018-7780 | Critical | 9.8 | 2018-07-03 | In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi pro… |
CVE-2018-7779 | High | 7.5 | 2018-07-03 | In Schneider Electric Wiser for KNX V2.1.0 and prior, homeLYnk V2.0.1 and prior; and spaceLYnk V2.1.0 and prior, weak and unprotected FTP access could allow an… |
CVE-2018-7778 | Critical | 9.8 | 2018-07-03 | In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12_v1, the Web Interface has an issue that may allow a remote attacker to gain administr… |
CVE-2018-7777 | High | 8.8 | 2018-07-03 | The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software version… |
CVE-2018-7776 | Medium | 4.3 | 2018-07-03 | The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attac… |
CVE-2018-7774 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of localize.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite data… |
CVE-2018-7773 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite dat… |
CVE-2018-7772 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1… |
CVE-2018-7771 | High | 8.0 | 2018-07-03 | The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vu… |
CVE-2018-7770 | Medium | 6.5 | 2018-07-03 | The vulnerability exists within processing of sendmail.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The applet allows callers… |
CVE-2018-7769 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of xmlserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite dat… |
CVE-2018-7768 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite… |
CVE-2018-7767 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of editobject.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite da… |
CVE-2018-7766 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of track_getdata.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite… |
CVE-2018-7765 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying… |
CVE-2018-7764 | Medium | 4.3 | 2018-07-03 | The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal v… |
CVE-2018-7763 | Medium | 4.3 | 2018-07-03 | The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The 'css' parameter contains a directory… |
CVE-2017-9637 | Medium | 4.1 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to us… |
CVE-2017-9635 | Low | 3.9 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a wea… |
CVE-2017-6021 | High | 7.5 | 2018-05-14 | In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build… |
CVE-2018-7762 | High | 7.5 | 2018-04-18 | A vulnerability exists in the web services to process SOAP requests in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 whic… |
CVE-2018-7761 | Critical | 9.8 | 2018-04-18 | A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow arbi… |
CVE-2018-7760 | Critical | 9.8 | 2018-04-18 | An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions… |
CVE-2018-7759 | High | 7.5 | 2018-04-18 | A buffer overflow vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. The buffer overflow vulnerabilit… |
CVE-2018-7758 | Medium | 6.5 | 2018-04-18 | A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board, MiCOM P540D Range with Legacy Eth… |
CVE-2018-7246 | Critical | 9.8 | 2018-04-18 | A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UP… |
CVE-2018-7245 | Critical | 9.1 | 2018-04-18 | An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integ… |
CVE-2018-7244 | Medium | 5.3 | 2018-04-18 | An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integ… |
CVE-2018-7243 | Critical | 9.8 | 2018-04-18 | An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integra… |
CVE-2018-7242 | Critical | 9.8 | 2018-04-18 | Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the com… |
CVE-2018-7241 | Critical | 9.8 | 2018-04-18 | Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communicati… |
CVE-2018-7240 | High | 8.8 | 2018-04-18 | A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution. An FTP… |
CVE-2018-7239 | High | 7.8 | 2018-03-09 | A DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could… |
CVE-2018-7238 | Critical | 9.8 | 2018-03-09 | A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which cou… |
CVE-2018-7237 | Critical | 9.1 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete… |
CVE-2018-7236 | High | 8.1 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could enable SSH service due to lack of… |
CVE-2018-7235 | High | 7.5 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file downl… |
CVE-2018-7234 | High | 7.5 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file downl… |
CVE-2018-7233 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2018-7232 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2018-7231 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow execution of commands due t… |
CVE-2018-7230 | High | 8.8 | 2018-03-09 | A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all f… |
CVE-2018-7229 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote… |
CVE-2018-7228 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote… |
CVE-2018-7227 | Medium | 5.3 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow retrieving of specially cra… |