CVE-2019-6840
Critical
Description
A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow an attacker to send a crafted message to the target server, thereby causing arbitrary commands to be executed.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSchneider-electric Meg6501-0001 Firmware
PublishedSep 17, 2019
First seenSep 17, 2019
Weakness typeCWE-134CWE-134
How to fix
Update
- schneider-electric meg6501-0001_firmware1.3.7 or later
- schneider-electric meg6501-0002_firmware1.3.7 or later
- schneider-electric meg6260-0410_firmware1.3.7 or later
- schneider-electric meg6260-0415_firmware1.3.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric meg6501-0001_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6501-0002_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6260-0410_firmware | v < 1.3.7 | 1.3.7 |
| schneider-electric meg6260-0415_firmware | v < 1.3.7 | 1.3.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.