CyberSec.Space Logo
Back to CVE Browser

CVE-2019-6852

HIGH
7.5
CVSS Severity Score
EPSS Score0.1020%
EPSS Percentile25.55th
PublishedNov 20, 2019
Last ModifiedMay 28, 2026

Vulnerability Description

A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.

Affected Platforms (CPE)

💻
Schneider Electric

Bmx P34x Firmware

All versions
💻
Schneider Electric

Bmx Noe 0100 Firmware

All versions
💻
Schneider Electric

Bmx Noe 0110 Firmware

All versions
💻
Schneider Electric

Bmx Noc 0401 Firmware

All versions
💻
Schneider Electric

Tsx P57x Firmware

All versions
💻
Schneider Electric

Tsx Ety X103 Firmware

All versions
💻
Schneider Electric

140 Cpu6x Firmware

All versions
💻
Schneider Electric

140 Noe 771x1 Firmware

All versions
💻
Schneider Electric

140 Noc 78x00 Firmware

All versions
💻
Schneider Electric

140 Noc 77101 Firmware

All versions

References & Advisories

🔗 https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/
🔗 https://www.se.com/ww/en/download/document/SEVD-2019-316-02%20/
🔗 https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/

Related Vulnerabilities

CVE-2019-002010.0

Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full contr...

CVE-2019-002210.0

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full contro...

CVE-2019-390510.0

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.

CVE-2019-623510.0

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12...