CVE-2015-7937

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.

Score

CVSS 2.0 10.0 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2015-12-21

Last modified

2024-08-06

Weaknesses

CWE-119

Affected products

• Bmxnoc0401 (Schneider-electric)
• Bmxnoe0100 (Schneider-electric)
• Bmxnoe0100h (Schneider-electric)
• Bmxnoe0110 (Schneider-electric)
• Bmxnoe0110h (Schneider-electric)
• Bmxnor0200 (Schneider-electric)
• Bmxnor0200h (Schneider-electric)
• Bmxpra0100 (Schneider-electric)
• Modicon M340 Bmxp342020 (Schneider-electric)
• Modicon M340 Bmxp342020h (Schneider-electric)
• Modicon M340 Bmxp342030 (Schneider-electric)
• Modicon M340 Bmxp3420302 (Schneider-electric)
• Modicon M340 Bmxp3420302h (Schneider-electric)

References

• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-344-01
• http://www.securityfocus.com/bid/79622
• https://ics-cert.us-cert.gov/advisories/ICSA-15-351-01