CyberSec.Space Logo
Back to CVE Browser

CVE-2015-7937

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.1780%
EPSS Percentile27.68th
PublishedDec 21, 2015
Last ModifiedMay 6, 2026

Vulnerability Description

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.

Affected Platforms (CPE)

🔌
Schneider Electric

Bmxnoc0401

All versions
🔌
Schneider Electric

Bmxnoe0100

All versions
🔌
Schneider Electric

Bmxnoe0100h

All versions
🔌
Schneider Electric

Bmxnoe0110

All versions
🔌
Schneider Electric

Bmxnoe0110h

All versions
🔌
Schneider Electric

Bmxnor0200

All versions
🔌
Schneider Electric

Bmxnor0200h

All versions
🔌
Schneider Electric

Bmxpra0100

All versions
🔌
Schneider Electric

Modicon M340 Bmxp342020

All versions
🔌
Schneider Electric

Modicon M340 Bmxp342020h

All versions
🔌
Schneider Electric

Modicon M340 Bmxp342030

All versions
🔌
Schneider Electric

Modicon M340 Bmxp3420302

All versions
🔌
Schneider Electric

Modicon M340 Bmxp3420302h

All versions

References & Advisories

🔗 http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-344-01
🔗 http://www.securityfocus.com/bid/79622
🔗 https://ics-cert.us-cert.gov/advisories/ICSA-15-351-01
🔗 http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-344-01
🔗 http://www.securityfocus.com/bid/79622
🔗 https://ics-cert.us-cert.gov/advisories/ICSA-15-351-01

Related Vulnerabilities

CVE-2014-075410.0

Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 14...

CVE-2020-75348.8

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive dat...

CVE-2021-227857.5

A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root direc...

CVE-2021-227877.5

A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a...