CVE-2019-6851
High
Description
A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information from the controller when using TFTP protocol.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSchneider-electric Modicon M580 Firmware
PublishedOct 29, 2019
First seenOct 29, 2019
Weakness typeCWE-538CWE-538
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric modicon_m580_firmware | No range specified | — |
| schneider-electric modicon_m340_firmware | No range specified | — |
| schneider-electric tsxmcpc002m_firmware | No range specified | — |
| schneider-electric tsxmcpc512k_firmware | No range specified | — |
| schneider-electric tsxmfpp001m_firmware | No range specified | — |
| schneider-electric tsxmfpp002m_firmware | No range specified | — |
| schneider-electric tsxmfpp004m_firmware | No range specified | — |
| schneider-electric tsxmfpp512k_firmware | No range specified | — |
| schneider-electric tsxmrpc001m_firmware | No range specified | — |
| schneider-electric tsxmrpc002m_firmware | No range specified | — |
| schneider-electric tsxmrpc003m_firmware | No range specified | — |
| schneider-electric tsxmrpc007m_firmware | No range specified | — |
| schneider-electric tsxmrpc01m7_firmware | No range specified | — |
| schneider-electric tsxmrpc768k_firmware | No range specified | — |
| schneider-electric tsxmrpf004m_firmware | No range specified | — |
| schneider-electric tsxmrpf008m_firmware | No range specified | — |
| schneider-electric tsxmfp0128p2_firmware | No range specified | — |
| schneider-electric tsxmfp064p2_firmware | No range specified | — |
| schneider-electric tsxmfpp224k_firmware | No range specified | — |
| schneider-electric tsxmfpp384k_firmware | No range specified | — |
| schneider-electric tsxmrpc448k_firmware | No range specified | — |
| schneider-electric tsxmrpp224k_firmware | No range specified | — |
| schneider-electric tsxmrpp384k_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.