CVE-2015-6462
Medium
Description
Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser.
SeverityMedium
CVSS5.4
Exploit probability—
ProductSchneider-electric Bmxnoc0401 Firmware
PublishedMar 21, 2019
First seenMar 21, 2019
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric bmxnoc0401_firmware | No range specified | — |
| schneider-electric bmxnoe0100_firmware | No range specified | — |
| schneider-electric bmxnoe0110_firmware | No range specified | — |
| schneider-electric bmxnoe0110h_firmware | No range specified | — |
| schneider-electric bmxnor0200h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp342020_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp342020h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp342030_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp3420302_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp3420302h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmxp342030h_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.