Unscored severity · published Apr 4, 2013
CVE-2013-0663
Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and…
–
CVSS
6%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.0% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Modicon M340 · Schneider-electric
bmxnoc0401; bmxnoe011xx; bmxnoe0100x · source: NVD
MP
Modicon Premium · Schneider-electric
tsxety4103; tsxety5103; tsxwmy100 · source: NVD
MQ
Modicon Quantum Plc · Schneider-electric
140noe77101; 140noe77111; 140nwm10000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0663
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0663
US Government Resource
http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf
Vendor Advisory
http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/
Vendor Advisory
http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper
www.exploit-db.com
https://www.exploit-db.com/exploits/44678/
More from Modicon M340
8.1
CVE-2024-8938
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful…
7.5
CVE-2025-6625
CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device
7.5
CVE-2024-8933
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead…
6.5
CVE-2024-5056
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver…
–
CVE-2013-2761
The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module crash) via crafted FTP traffic, as…