CVE-2019-6837
Critical
Description
A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could cause server configuration data to be exposed when an attacker modifies a URL.
SeverityCritical
CVSS9.1
Exploit probability—
ProductSchneider-electric Meg6501-0001 Firmware
PublishedSep 17, 2019
First seenSep 17, 2019
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- schneider-electric meg6501-0001_firmware1.3.7 or later
- schneider-electric meg6501-0002_firmware1.3.7 or later
- schneider-electric meg6260-0410_firmware1.3.7 or later
- schneider-electric meg6260-0415_firmware1.3.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric meg6501-0001_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6501-0002_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6260-0410_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6260-0415_firmware | v < 1.3.7 | 1.3.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.