CVE-2015-6461
Medium
Description
Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.
SeverityMedium
CVSS5.4
Exploit probability—
ProductSchneider-electric Bmxnoc0401 Firmware
PublishedMar 21, 2019
First seenMar 21, 2019
Weakness typeCWE-98CWE-98
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric bmxnoc0401_firmware | No range specified | — |
| schneider-electric bmxnoe0100_firmware | No range specified | — |
| schneider-electric bmxnoe0110_firmware | No range specified | — |
| schneider-electric bmxnoe0110h_firmware | No range specified | — |
| schneider-electric bmxnor0200h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp342020_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp342020h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp342030_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp3420302_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp3420302h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp342030h_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.