High severity · published May 22, 2019
CVE-2019-6820
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP…
8.2
CVSS
1.3%
EPSS
No
On KEV
Description
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Atv Imc Drive Controller Firmware · Schneider-electric
All versions, or not specified · source: NVD
ML
Modicon Lmc058 Firmware · Schneider-electric
All versions, or not specified · source: NVD
ML
Modicon Lmc078 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M100 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M200 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M221 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M241 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M251 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M258 Firmware · Schneider-electric
All versions, or not specified · source: NVD
PE
Pacdrive Eco Firmware · Schneider-electric
All versions, or not specified · source: NVD
PP
Pacdrive Pro Firmware · Schneider-electric
All versions, or not specified · source: NVD
PP
Pacdrive Pro2 Firmware · Schneider-electric
All versions, or not specified · source: NVD
Affected product
AI
Atv Imc Drive Controller Firmware
Schneider-electric