CVE-2019-6808

CWE-306 — Missing Authentication4 documents4 sources
Severity
9.8CRITICAL
EPSS
2.4%
top 14.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Schneider-electric Modicon M340 FirmwareSchneider-electric Modicon M580 FirmwareSchneider-electric Modicon Premium Firmware+1 more
Timeline
PublishedMay 22
Latest updateMay 24

Description

A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5modicon_m580_modicon_m340_modicon_quantum_modicon_premiumModicon M580 Modicon M340 Modicon Quantum Modicon Premium

🔴Vulnerability Details

3
GHSA
GHSA-gcj2-7vc3-x83p: A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which↗2022-05-24
▶
OSV
firefox vulnerabilities↗2020-03-11
▶
CVEList
CVE-2019-6808: A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which↗2019-05-22
▶
CVE-2019-6808 (CRITICAL CVSS 9.8) | A CWE-284: Improper Access Control | cvebase.io