Schneider-Electric
Page 6 of 9 — Schneider-Electric CVEs from a corpus of 880, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7522 | Critical | 9.8 | 2020-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earl… |
CVE-2020-7521 | Critical | 9.8 | 2020-08-31 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC Easy UPS On-Line Software (V2.0 and earl… |
CVE-2020-7520 | Medium | 4.7 | 2020-07-23 | A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could… |
CVE-2020-7519 | High | 7.5 | 2020-07-23 | A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user ac… |
CVE-2020-7518 | High | 7.5 | 2020-07-23 | A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to modify project configu… |
CVE-2020-7517 | Medium | 5.5 | 2020-07-23 | A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to read… |
CVE-2020-7516 | High | 7.8 | 2020-07-23 | A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker access… |
CVE-2020-7515 | High | 7.8 | 2020-07-23 | A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker to… |
CVE-2020-7514 | High | 7.8 | 2020-07-23 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker a… |
CVE-2020-7491 | High | 7.5 | 2020-07-23 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network… |
CVE-2020-7513 | High | 7.5 | 2020-06-16 | A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to… |
CVE-2020-7512 | Critical | 9.8 | 2020-06-16 | A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which… |
CVE-2020-7511 | High | 7.5 | 2020-06-16 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attack… |
CVE-2020-7510 | High | 7.5 | 2020-06-16 | A CWE-200: Information Exposure vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow attacker to obtain private keys. |
CVE-2020-7509 | High | 7.2 | 2020-06-16 | A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to eleva… |
CVE-2020-7508 | Critical | 9.8 | 2020-06-16 | A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow a… |
CVE-2020-7507 | High | 7.5 | 2020-06-16 | A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to login mul… |
CVE-2020-7506 | High | 7.5 | 2020-06-16 | A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or unpack the archive wi… |
CVE-2020-7505 | High | 7.2 | 2020-06-16 | A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to inj… |
CVE-2020-7504 | Medium | 5.3 | 2020-06-16 | A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to disable the webser… |
CVE-2020-7503 | High | 8.8 | 2020-06-16 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to execute m… |
CVE-2020-7502 | High | 7.5 | 2020-06-16 | A CWE-787: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (Firmware version 4.3 and prior), which may cause a Denial of Service when… |
CVE-2020-7501 | High | 8.8 | 2020-06-16 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which… |
CVE-2020-7500 | Critical | 9.8 | 2020-06-16 | A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affect… |
CVE-2020-7499 | Medium | 6.5 | 2020-06-16 | A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which coul… |
CVE-2020-7498 | Critical | 9.8 | 2020-06-16 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simp… |
CVE-2020-7497 | Critical | 9.8 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Servi… |
CVE-2020-7495 | Medium | 5.5 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure Operato… |
CVE-2020-7494 | High | 7.8 | 2020-06-16 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Servi… |
CVE-2020-7493 | High | 7.8 | 2020-06-16 | A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1… |
CVE-2020-7492 | Medium | 6.5 | 2020-06-16 | A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is… |
CVE-2020-10626 | High | 7.8 | 2020-05-14 | In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any… |
CVE-2020-7490 | High | 7.8 | 2020-04-22 | A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior), which could c… |
CVE-2020-7489 | Critical | 9.8 | 2020-04-22 | A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert… |
CVE-2020-7488 | High | 7.5 | 2020-04-22 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the… |
CVE-2020-7487 | Critical | 9.8 | 2020-04-22 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M2… |
CVE-2019-6859 | High | 7.5 | 2020-04-22 | A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product refere… |
CVE-2020-7486 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause TCM modules to reset when under high network load in TCM v10.4.x and in system v10.3.x. Thi… |
CVE-2020-7485 | Critical | 9.8 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy support account in the TriStation software version v4.9.0 and earlier could cause improper access to the TriSt… |
CVE-2020-7484 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability with the former 'password' feature could allow a denial of service attack if the user is not following… |
CVE-2020-7483 | High | 7.5 | 2020-04-16 | **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause certain data to be visible on the network when the 'password' feature is enabled. This vuln… |
CVE-2020-7482 | Medium | 6.1 | 2020-03-23 | A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which coul… |
CVE-2020-7481 | Medium | 6.1 | 2020-03-23 | A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which coul… |
CVE-2020-7480 | Critical | 9.8 | 2020-03-23 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the ap… |
CVE-2020-7479 | High | 7.8 | 2020-03-23 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a… |
CVE-2020-7478 | High | 7.5 | 2020-03-23 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a… |
CVE-2020-7477 | High | 7.5 | 2020-03-23 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (Versions 7.0 and prior), Q… |
CVE-2020-7476 | High | 7.8 | 2020-03-23 | A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior to 1.0.1), which could cause execution of malicious code when… |
CVE-2020-7475 | Critical | 9.8 | 2020-03-23 | A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxu… |
CVE-2020-7474 | High | 7.8 | 2020-03-23 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PMEPXM0100 (H) module, which could cause t… |
CVE-2019-6858 | High | 7.8 | 2020-01-22 | A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause privilege escalatio… |
CVE-2019-6857 | High | 7.5 | 2020-01-06 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see secur… |
CVE-2019-6856 | High | 7.5 | 2020-01-06 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see secur… |
CVE-2019-6855 | High | 7.3 | 2020-01-06 | Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all ve… |
CVE-2019-6854 | High | 7.8 | 2020-01-06 | A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases before 1 January 20… |
CVE-2018-7794 | High | 7.5 | 2020-01-06 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see secur… |
CVE-2019-6853 | Medium | 6.1 | 2019-11-20 | A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and… |
CVE-2019-6852 | High | 7.5 | 2019-11-20 | A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules… |
CVE-2019-6851 | High | 7.5 | 2019-10-29 | A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions… |
CVE-2019-6850 | High | 7.5 | 2019-10-29 | A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensiti… |
CVE-2019-6849 | High | 7.5 | 2019-10-29 | A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensiti… |
CVE-2019-6848 | High | 8.6 | 2019-10-29 | A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BM… |
CVE-2019-6847 | Medium | 4.9 | 2019-10-29 | A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware vers… |
CVE-2019-6846 | Medium | 6.5 | 2019-10-29 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware… |
CVE-2019-6845 | High | 7.5 | 2019-10-29 | A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware… |
CVE-2019-6844 | Medium | 4.9 | 2019-10-29 | A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware vers… |
CVE-2019-6843 | Medium | 4.9 | 2019-10-29 | A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware… |
CVE-2019-6842 | Medium | 4.9 | 2019-10-29 | A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware vers… |
CVE-2019-6841 | Medium | 4.9 | 2019-10-29 | A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware… |
CVE-2019-6840 | Critical | 9.8 | 2019-09-17 | A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U… |
CVE-2019-6839 | High | 8.8 | 2019-09-17 | A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion… |
CVE-2019-6838 | Medium | 6.5 | 2019-09-17 | A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG626… |
CVE-2019-6837 | Critical | 9.1 | 2019-09-17 | A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server P… |
CVE-2019-6836 | High | 7.5 | 2019-09-17 | A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG626… |
CVE-2019-6835 | Medium | 5.4 | 2019-09-17 | A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG62… |
CVE-2019-6833 | Medium | 6.5 | 2019-09-17 | A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, H… |
CVE-2019-6832 | High | 8.3 | 2019-09-17 | A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLY… |
CVE-2019-6831 | High | 8.6 | 2019-09-17 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which… |
CVE-2019-6830 | Medium | 5.9 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of service when sending an… |
CVE-2019-6829 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prior to V3.10), which… |
CVE-2019-6828 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Prem… |
CVE-2019-6826 | High | 7.8 | 2019-09-17 | A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code execution on the system r… |
CVE-2019-6813 | High | 7.5 | 2019-09-17 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions) and Mo… |
CVE-2019-6811 | High | 7.5 | 2019-09-17 | An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cau… |
CVE-2019-6810 | High | 8.8 | 2019-09-17 | CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of c… |
CVE-2019-6809 | High | 7.5 | 2019-09-17 | A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior to V3.10), Modicon… |
CVE-2018-7820 | Critical | 9.8 | 2019-09-17 | A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to b… |
CVE-2019-6827 | High | 7.8 | 2019-07-15 | A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System (IGSS), Version 14 and prior, which could cause a software crash when… |
CVE-2019-6825 | High | 7.8 | 2019-07-15 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow a malicious DLL file, with… |
CVE-2019-6824 | Critical | 9.8 | 2019-07-15 | A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated, remote attacker to execute arb… |
CVE-2019-6823 | Critical | 9.8 | 2019-07-15 | A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote attacker to execut… |
CVE-2019-6822 | High | 7.8 | 2019-07-15 | A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zeli… |
CVE-2018-7838 | High | 7.5 | 2019-07-15 | A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions… |
CVE-2019-10981 | High | 7.8 | 2019-05-31 | In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect u… |
CVE-2019-6808 | Critical | 9.8 | 2019-05-22 | A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cau… |
CVE-2019-6807 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a… |
CVE-2019-6806 | High | 7.5 | 2019-05-22 | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause… |
CVE-2018-7857 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a… |
CVE-2018-7856 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a… |
CVE-2018-7855 | High | 7.5 | 2019-05-22 | A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a D… |