Information Exposure Vulnerability in Schneider Electric Modicon PLCs

CVE-2018-7812

Summary

An information exposure vulnerability exists in the embedded web servers of Schneider Electric's Modicon M340, Premium, Quantum PLCs, and BMXNOR0200 devices. This vulnerability allows the web server to return inconsistent responses, potentially revealing sensitive security-related information about the operational state of the product. For instance, by analyzing the responses, it could be determined whether a specific operation was executed successfully or not, leading to risks of unauthorized access or manipulation of critical system functions.

References