CVE-2019-6820
High
Description
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2
SeverityHigh
CVSS8.2
Exploit probability—
ProductSchneider-electric Modicon M100 Firmware
PublishedMay 22, 2019
First seenMay 22, 2019
Weakness typeCWE-306Missing authentication for critical function
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric modicon_m100_firmware | No range specified | — |
| schneider-electric modicon_m200_firmware | No range specified | — |
| schneider-electric modicon_m221_firmware | No range specified | — |
| schneider-electric atv_imc_drive_controller_firmware | No range specified | — |
| schneider-electric modicon_m241_firmware | No range specified | — |
| schneider-electric modicon_m251_firmware | No range specified | — |
| schneider-electric modicon_m258_firmware | No range specified | — |
| schneider-electric modicon_lmc058_firmware | No range specified | — |
| schneider-electric modicon_lmc078_firmware | No range specified | — |
| schneider-electric pacdrive_eco_firmware | No range specified | — |
| schneider-electric pacdrive_pro_firmware | No range specified | — |
| schneider-electric pacdrive_pro2_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.