Filtered by vendor Schneider-electric Subscriptions
Total 765 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-6849 1 Schneider-electric 6 Modicon Bmenoc 0311, Modicon Bmenoc 0311 Firmware, Modicon Bmenoc 0321 and 3 more 2024-11-21 7.5 High
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module.
CVE-2019-6848 1 Schneider-electric 6 Modicon Bmenoc 0311, Modicon Bmenoc 0311 Firmware, Modicon Bmenoc 0321 and 3 more 2024-11-21 8.6 High
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BMENOC0321) (see notification for version info), which could cause a Denial of Service attack on the PLC when sending specific data on the REST API of the controller/communication module.
CVE-2019-6847 1 Schneider-electric 8 Modicon 140cra, Modicon 140cra Firmware, Modicon Bmxcra and 5 more 2024-11-21 4.9 Medium
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the FTP service when upgrading the firmware with a version incompatible with the application in the controller using FTP protocol.
CVE-2019-6846 1 Schneider-electric 8 Modicon 140cra, Modicon 140cra Firmware, Modicon Bmxcra and 5 more 2024-11-21 6.5 Medium
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause information disclosure when using the FTP protocol.
CVE-2019-6845 1 Schneider-electric 46 Modicon M340, Modicon M340 Firmware, Modicon M580 and 43 more 2024-11-21 7.5 High
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information when transferring applications to the controller using Modbus TCP protocol.
CVE-2019-6844 1 Schneider-electric 8 Modicon 140cra, Modicon 140cra Firmware, Modicon Bmxcra and 5 more 2024-11-21 4.9 Medium
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service atack on the PLC when upgrading the controller with a firmware package containing an invalid web server image using FTP protocol.
CVE-2019-6843 1 Schneider-electric 8 Modicon 140cra, Modicon 140cra Firmware, Modicon Bmxcra and 5 more 2024-11-21 4.9 Medium
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the controller with an empty firmware package using FTP protocol.
CVE-2019-6842 1 Schneider-electric 8 Modicon 140cra, Modicon 140cra Firmware, Modicon Bmxcra and 5 more 2024-11-21 4.9 Medium
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the firmware with a missing web server image inside the package using FTP protocol.
CVE-2019-6841 1 Schneider-electric 8 Modicon 140cra, Modicon 140cra Firmware, Modicon Bmxcra and 5 more 2024-11-21 4.9 Medium
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon M340 (all firmware versions), and Modicon BMxCRA and 140CRA modules (all firmware versions), which could cause a Denial of Service attack on the PLC when upgrading the firmware with no firmware image inside the package using FTP protocol.
CVE-2019-6840 1 Schneider-electric 8 Meg6260-0410, Meg6260-0410 Firmware, Meg6260-0415 and 5 more 2024-11-21 9.8 Critical
A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow an attacker to send a crafted message to the target server, thereby causing arbitrary commands to be executed.
CVE-2019-6839 1 Schneider-electric 8 Meg6260-0410, Meg6260-0410 Firmware, Meg6260-0415 and 5 more 2024-11-21 8.8 High
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow a user with low privileges to upload a rogue file.
CVE-2019-6838 1 Schneider-electric 8 Meg6260-0410, Meg6260-0410 Firmware, Meg6260-0415 and 5 more 2024-11-21 6.5 Medium
A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow a user with low privileges to delete a critical file.
CVE-2019-6837 1 Schneider-electric 8 Meg6260-0410, Meg6260-0410 Firmware, Meg6260-0415 and 5 more 2024-11-21 9.1 Critical
A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could cause server configuration data to be exposed when an attacker modifies a URL.
CVE-2019-6836 1 Schneider-electric 8 Meg6260-0410, Meg6260-0410 Firmware, Meg6260-0415 and 5 more 2024-11-21 7.5 High
A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow the file system to access the wrong file.
CVE-2019-6835 1 Schneider-electric 8 Meg6260-0410, Meg6260-0410 Firmware, Meg6260-0415 and 5 more 2024-11-21 5.4 Medium
A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow an attacker to inject client-side script when a user visits a web page.
CVE-2019-6834 1 Schneider-electric 1 Software Update 2024-11-21 7.3 High
A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted system with SYSTEM privileges when placing a malicious user to be authenticated for this vulnerability to be successfully exploited. Affected Product: Schneider Electric Software Update (SESU) SUT Service component (V2.1.1 to V2.3.0)
CVE-2019-6833 1 Schneider-electric 49 Hmig2u, Hmig3u, Hmig3ufc and 46 more 2024-11-21 6.5 Medium
A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU), which could cause a temporary freeze of the HMI when a high rate of frames is received. When the attack stops, the buffered commands are processed by the HMI panel.
CVE-2019-6832 1 Schneider-electric 4 Lss100100, Lss100200, Spacelynk Firmware and 1 more 2024-11-21 8.3 High
A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLYnk), which could cause loss of control when an attacker bypasses the authentication.
CVE-2019-6831 1 Schneider-electric 2 Bmxnor0200h, Bmxnor0200h Firmware 2024-11-21 8.6 High
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause disconnection of active connections when an unusually high number of IEC 60870- 5-104 packets are received by the module on port 2404/TCP.
CVE-2019-6830 1 Schneider-electric 2 Modicon M580, Modicon M580 Firmware 2024-11-21 5.9 Medium
A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of service when sending an appropriately timed HTTP request to the controller.