High severity · published Oct 29, 2019
CVE-2019-6850
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when…
7.5
CVSS
1.7%
EPSS
No
On KEV
Description
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when reading specific registers with the REST API of the controller/communication module.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Modicon Bmenoc 0311 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MB
Modicon Bmenoc 0321 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M580 Firmware · Schneider-electric
All versions, or not specified · source: NVD
Affected product
MB
Modicon Bmenoc 0311 Firmware
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6850
Vendor Advisory
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04
More from Modicon Bmenoc 0311 Firmware
8.6
CVE-2019-6848
A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication module (BMENOC0311, BMENOC0321) (see…
7.5
CVE-2019-6849
A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when…