CVE-2015-6461

Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.

Score

CVSS 3.0 5.4 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2019-03-21

Last modified

2024-08-06

Weaknesses

CWE-20, CWE-98

Affected products

• Bmxnoc0401 Firmware (Schneider-electric)
• Bmxnoe0100 Firmware (Schneider-electric)
• Bmxnoe0110 Firmware (Schneider-electric)
• Bmxnoe0110h Firmware (Schneider-electric)
• Bmxnor0200h Firmware (Schneider-electric)
• Modicon M340 Bmxp342020 Firmware (Schneider-electric)
• Modicon M340 Bmxp342020h Firmware (Schneider-electric)
• Modicon M340 Bmxp3420302 Firmware (Schneider-electric)
• Modicon M340 Bmxp3420302h Firmware (Schneider-electric)
• Modicon M340 Bmxp342030 Firmware (Schneider-electric)
• Modicon M340 Bmxp342030h Firmware (Schneider-electric)

References

• https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02