High severity · published Jan 6, 2020
CVE-2019-6855
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to…
7.3
CVSS
1%
EPSS
No
On KEV
Description
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Ecostruxure Control Expert · Schneider-electric
before 14.1; 14.1 · source: NVD
MM
Modicon M340 Bmxp341000 Firmware · Schneider-electric
before 3.20 · source: NVD
MM
Modicon M340 Bmxp342000 Firmware · Schneider-electric
before 3.20 · source: NVD
MM
Modicon M340 Bmxp3420102 Firmware · Schneider-electric
before 3.20 · source: NVD
MM
Modicon M340 Bmxp342020 Firmware · Schneider-electric
before 3.20 · source: NVD
MM
Modicon M340 Bmxp3420302 Firmware · Schneider-electric
before 3.20; before 3.20 · source: NVD
MM
Modicon M580 Bmeh582040 Firmware · Schneider-electric
before 3.10 · source: NVD
MM
Modicon M580 Bmeh584040 Firmware · Schneider-electric
before 3.10 · source: NVD
MM
Modicon M580 Bmeh584040s Firmware · Schneider-electric
before 3.10 · source: NVD
MM
Modicon M580 Bmeh586040 Firmware · Schneider-electric
before 3.10 · source: NVD
MM
Modicon M580 Bmeh586040s Firmware · Schneider-electric
before 3.10 · source: NVD
MM
Modicon M580 Bmep581020 Firmware · Schneider-electric
before 3.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6855
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6855
Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2019-344-02/
More from Ecostruxure Control Expert
9.8
CVE-2022-45789
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an…
9.8
CVE-2022-45788
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality &…
9.8
CVE-2022-37300
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when…
9.8
CVE-2022-26507
A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7
9.8
CVE-2020-28212
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could…