SB2019112107 - Information disclosure in multiple Modicon Controllers
Published: November 21, 2019
Security Bulletin ID
SB2019112107
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2019-6852)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the File Transfer Protocol (FTP) uses hardcoded credentials to automate the file transfer process. A remote attacker can use the Web server of the controller on an unsecure network and disclose the FTP hardcoded credentials.
This vulnerability affects the following products:
- M340 CPUs:
BMX P34x
- M340 communication modules:
BMX NOE 0100
BMX NOE 0110
BMX NOC 0401
- Premium CPUs:
TSX P57x
- Premium communication modules:
TSX ETY x103
- Quantum CPUs:
140 CPU6x
- Quantum communication modules:
140 NOE 771x1
140 NOC 78x00
140 NOC 77101
Remediation
Install update from vendor's website.