Remote File Inclusion Vulnerability in Schneider Electric PLCs
CVE-2015-6461

5.4MEDIUM

Key Information:

Vendor
Schneider Electric
Status
Schneider Electric Modicon Plc
Vendor
CVE Published:
21 March 2019

Summary

This vulnerability allows an attacker to exploit affected Schneider Electric Modicon PLC web servers by crafting a specific URL. When the URL is accessed, it triggers a redirect to a remote file through a JavaScript executed during the page load, potentially enabling the attacker to expose sensitive information or manipulate system settings.

Affected Version(s)

Schneider Electric Modicon PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H.

References

https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.